@wildo-ai/saas-backend-lib 1.1.2 → 1.1.4

package/dist/esm/security/authentications/services/utils/auth-user-lookup.backend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-user-lookup.backend.service.js","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/utils/auth-user-lookup.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAE7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,iBAAiB,EAAE,mCAAmC,EAAE,MAAM,uBAAuB,CAAC;AAE7H,OAAO,EAAE,6BAA6B,EAAE,MAAM,gFAAgF,CAAC;AAC/H,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAC3H,OAAO,EAAE,yBAAyB,EAAE,MAAM,+FAA+F,CAAC;AAK1I,OAAO,EACL,oCAAoC,GACrC,MAAM,wCAAwC,CAAC;AAEhD;;;;GAIG;AAEI,IAAM,4BAA4B,GAAlC,MAAM,4BAA4B;IAIe;IACwB;IACd;IAGQ;IACL;IATlD,QAAQ,CAA+D;IAExF,YACsD,MAAqB,EACG,uBAA8D,EAC5E,gBAAyC,EAGjC,iBAAkD,EACvD,mBAA+C;QAN5D,WAAM,GAAN,MAAM,CAAe;QACG,4BAAuB,GAAvB,uBAAuB,CAAuC;QAC5E,qBAAgB,GAAhB,gBAAgB,CAAyB;QAGjC,sBAAiB,GAAjB,iBAAiB,CAAiC;QACvD,wBAAmB,GAAnB,mBAAmB,CAA4B;QAEhH,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IAC3D,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe,CAAC,EAAyB,EAAE,KAAa;QAC5D,OAAO,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAO,gBAAgB,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IACxI,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,kBAAkB,CACtB,EAAyB,EACzB,KAAa,EACb,cAA+B;QAE/B,OAAO,IAAI,CAAC,uBAAuB,CAAC,IAAI,CACtC,gBAAgB,CAAC,KAAK,EACtB,EAAE,EACF,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,EAC9B,cAAc,CACf,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAAC,EAAyB,EAAE,MAAc;QAC1D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAiC,gBAAgB,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QAClI,OAAO,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,EAAyB,EAAE,MAAc;QAC1D,OAAO,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAO,gBAAgB,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,KAAK,CAAC,2BAA2B,CAAC,EAAyB,EAAE,MAAc;QACzE,OAAO,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAkB,gBAAgB,CAAC,gBAAgB,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/G,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,0BAA0B;IAC9B,iGAAiG;IACjG,kGAAkG;IAClG,mGAAmG;IACnG,GAA0B,EAC1B,MAAc,EACd,QAAgB;QAEhB,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACxE,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAE5B,IAAI,CAAC;YACH,wGAAwG;YACxG,yGAAyG;YACzG,wGAAwG;YACxG,0GAA0G;YAC1G,0GAA0G;YAC1G,wGAAwG;YACxG,sGAAsG;YACtG,MAAM,YAAY,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;YAEvF,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAC;YAEhD,MAAM,iBAAiB,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC;YAC/E,MAAM,YAAY,GAA2B,EAAE,CAAC;YAChD,2FAA2F;YAC3F,gGAAgG;YAChG,kFAAkF;YAClF,+EAA+E;YAC/E,qGAAqG;YACrG,gGAAgG;YAChG,4EAA4E;YAC5E,mDAAmD;YACnD,IAAI,mBAAmB,GAAG,KAAK,CAAC;YAEhC,KAAK,MAAM,cAAc,IAAI,YAAY,EAAE,CAAC;gBAC1C,IAAI,CAAC;oBACH,+FAA+F;oBAC/F,yFAAyF;oBACzF,mGAAmG;oBACnG,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,CACrD,gBAAgB,CAAC,aAAa,EAAE,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAC9E,CAAC;oBACF,IAAI,GAAG,EAAE,IAAI,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,CAAC;wBAC5D,YAAY,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,aAAc,CAAC,CAAC;oBAChE,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,4DAA4D;gBAC9D,CAAC;gBACD,IAAI,CAAC,mBAAmB,EAAE,CAAC;oBACzB,IAAI,CAAC;wBACH,MAAM,YAAY,GAAG,MAAM,6BAA6B,CAAC;4BACvD,cAAc;4BACd,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;4BACzC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;yBAC9C,CAAC,CAAC;wBACH,6FAA6F;wBAC7F,kGAAkG;wBAClG,kGAAkG;wBAClG,mGAAmG;wBACnG,oFAAoF;wBACpF,IAAI,YAAY,EAAE,CAAC;4BACjB,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAC9D,gBAAgB,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAChG,CAAC;4BACF,IAAI,YAAY;gCAAE,mBAAmB,GAAG,IAAI,CAAC;wBAC/C,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,+FAA+F;wBAC/F,gGAAgG;wBAChG,6FAA6F;oBAC/F,CAAC;gBACH,CAAC;YACH,CAAC;YAED,6FAA6F;YAC7F,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,mBAAmB;gBAAE,OAAO,SAAS,CAAC;YAExE,kGAAkG;YAClG,IAAI,gBAAgC,CAAC;YACrC,IAAI,YAAY,GAAG,SAAS,CAAC,SAAS,CAAC;YACvC,IAAI,iBAAiB,GAAG,SAAS,CAAC,cAAc,CAAC;YACjD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC;gBACrD,MAAM,QAAQ,GAAG,iBAAiB,CAAC;oBACjC,YAAY,EAAE,SAAS;oBACvB,YAAY;oBACZ,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;oBACnD,oBAAoB,EAAE,UAAU,CAAC,oBAAoB;iBACtD,CAAC,CAAC;gBACH,gBAAgB,GAAG,QAAQ,CAAC,kBAAkB,CAAC;gBAC/C,YAAY,GAAG,QAAQ,CAAC,SAAS,CAAC;gBAClC,iBAAiB,GAAG,QAAQ,CAAC,cAAc,CAAC;YAC9C,CAAC;iBAAM,CAAC;gBACN,gBAAgB,GAAG,SAAS,CAAC,kBAAoC,CAAC;YACpE,CAAC;YAED,gGAAgG;YAChG,+FAA+F;YAC/F,MAAM,kBAAkB,GAAG,mBAAmB;gBAC5C,CAAC,CAAC,mCAAmC,CAAC,gBAAgB,CAAC;gBACvD,CAAC,CAAC,gBAAgB,CAAC;YAErB,OAAO;gBACL,GAAG,SAAS;gBACZ,kBAAkB,EAAE,kBAA8D;gBAClF,SAAS,EAAE,YAAY;gBACvB,cAAc,EAAE,iBAAiB;aAClC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,QAAQ,CAAC,+EAA+E,EAAE;gBAC7F,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK;gBACtC,QAAQ;gBACR,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACtC,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,2BAA2B,CACzB,QAAgB,EAChB,OAA2B;QAE3B,OAAO,oCAAoC,CACzC,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAC5B,QAAQ,EACR,OAAO,EACP,IAAI,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CACtD,CAAC;IACJ,CAAC;CACF,CAAA;AAhOY,4BAA4B;IADxC,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAG3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,CAAA;IACnD,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;qCANa,aAAa,YAEO,uBAAuB;GAN9F,4BAA4B,CAgOxC","sourcesContent":["import 'reflect-metadata';\nimport { injectable, inject } from 'inversify';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport type { ServicesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/services/services-registry-handler.backend.service';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { CoreResourceType, UserStatus, resolveAuthConfig, disableDirectoryIncompatibleMethods } from '@wildo-ai/saas-models';\nimport type { User, UserPreferences, UserTypeAuthPolicy, OrgTypeAuthOverrides, AuthMethodsMap } from '@wildo-ai/saas-models';\nimport { isOrgActivelyDirectoryManaged } from '~wildo-backend-lib/organizations/services/scim-provisioning-gate.backend.utils';\nimport { projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { resolveActiveMemberOrgIds } from '~wildo-backend-lib/security/authentications/services/resolve-active-member-orgs.backend.utils';\nimport type { FeatureResolutionBackendService } from '~wildo-backend-lib/features/services/feature-resolution.backend.service';\nimport type { SystemAccessBackendService } from '~wildo-backend-lib/base-classes/services/services/system-access.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport type { ServiceOptions } from '~wildo-backend-lib/base-classes/models/repositories.backend.schemas';\nimport {\n  resolveAuthPolicyForOrganizationType,\n} from './auth-policy-resolution.backend.utils';\n\n/**\n * User lookup helpers extracted from controller private methods.\n * Provides email-based lookups for Users and effective auth policy resolution\n * with org override merging (W5.8 / AUTH-14).\n */\n@injectable()\nexport class AuthUserLookupBackendService {\n  private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.ServicesRegistryHandlerService) private readonly servicesRegistryHandler: ServicesRegistryHandlerBackendService,\n    @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n    // AUTH-24: resolve per-org directory-management posture (DIRECTORY_PROVISIONING feature + a live SCIM\n    // token) to derive local first-factor credential methods OFF the effective policy for a managed user.\n    @inject(SAAS_SERVICE_TYPES.FeatureResolutionService) private readonly featureResolution: FeatureResolutionBackendService,\n    @inject(SAAS_SERVICE_TYPES.SystemAccessService) private readonly systemAccessService: SystemAccessBackendService,\n  ) {\n    this.logDebug = this.logger.debugByType('AuthUserLookup');\n    this.logger.setDebugTypeLogging('AuthUserLookup', false);\n  }\n\n  /**\n   * Find a user by email address (ACTIVE only).\n   * Returns null if not found — used by password reset which must not leak info.\n   */\n  async findUserByEmail(ec: ExecutionContext<any>, email: string): Promise<User | null> {\n    return this.servicesRegistryHandler.read<User>(CoreResourceType.USERS, ec, { email: email.toLowerCase(), status: UserStatus.ACTIVE });\n  }\n\n  /**\n   * Find a user by email address (any status).\n   * Used by registration to check email uniqueness across ALL statuses.\n   */\n  async findAnyUserByEmail(\n    ec: ExecutionContext<any>,\n    email: string,\n    serviceOptions?: ServiceOptions,\n  ): Promise<User | null> {\n    return this.servicesRegistryHandler.read<User>(\n      CoreResourceType.USERS,\n      ec,\n      { email: email.toLowerCase() },\n      serviceOptions,\n    );\n  }\n\n  /**\n   * Look up a user's email for audit/display purposes.\n   * Returns empty string if not found.\n   */\n  async getUserEmail(ec: ExecutionContext<any>, userId: string): Promise<string> {\n    const user = await this.servicesRegistryHandler.read<{ _id: string; email: string }>(CoreResourceType.USERS, ec, { _id: userId });\n    return user?.email ?? '';\n  }\n\n  async findUserById(ec: ExecutionContext<any>, userId: string): Promise<User | null> {\n    return this.servicesRegistryHandler.read<User>(CoreResourceType.USERS, ec, { _id: userId });\n  }\n\n  async findUserPreferencesByUserId(ec: ExecutionContext<any>, userId: string): Promise<UserPreferences | null> {\n    return this.servicesRegistryHandler.read<UserPreferences>(CoreResourceType.USER_PREFERENCES, ec, { userId });\n  }\n\n  /**\n   * AUTH-14 / W5.8: Resolve effective auth policy with org override merging.\n   *\n   * 1. Gets the raw UserTypeAuthPolicy from config\n   * 2. Fetches user's active org memberships\n   * 3. For each org, reads the org to get its type\n   * 4. Collects authOverrides from organizationTypes[orgType]\n   * 5. Calls resolveAuthConfig to merge (most-restrictive-wins)\n   * 6. Returns the full UserTypeAuthPolicy with overridable fields merged\n   *\n   * Fields affected by org overrides: authMethodsEnabled, mfaPolicy, passwordPolicy.\n   * All other fields (sessionDurationMinutes, lockoutPolicy, registration, etc.)\n   * come from the raw user-type policy unchanged.\n   */\n  async resolveEffectiveAuthPolicy(\n    // `_ec` is intentionally unused: AUTH-24 moved membership/org/link resolution to the SYSTEM door\n    // (see the body), which builds its own context — a login/session EC carries no trusted org scope.\n    // Kept in the signature for call-site stability and parity with the other lookups on this service.\n    _ec: ExecutionContext<any>,\n    userId: string,\n    userType: string,\n  ): Promise<UserTypeAuthPolicy | null> {\n    const rawPolicy = this.appConfigService.getUserTypeAuthPolicy(userType);\n    if (!rawPolicy) return null;\n\n    try {\n      // Resolve the user's ACTIVE org memberships via the SYSTEM door, NOT an ec-scoped read. A login/session\n      // is globally org-agnostic and its EC carries NO trusted org scope, so an ec-scoped ORGANIZATION_MEMBERS\n      // list surfaces only the user's PRIMARY-org membership and silently MISSES a CROSS-org membership (e.g.\n      // one a SCIM push just added) — which would defeat the user-global closure below (a user password-logs-in\n      // fine because the resolver never sees the managed org they were just provisioned into). See the incident\n      // note in `resolveActiveMemberOrgIds` — the same reason per-org audit routing must read the junction as\n      // system. That canonical resolver (`listAsSystem`, self-referential audit suppressed) is reused here.\n      const activeOrgIds = await resolveActiveMemberOrgIds(this.systemAccessService, userId);\n\n      if (activeOrgIds.length === 0) return rawPolicy;\n\n      const organizationTypes = this.appConfigService.config.organizationTypes ?? {};\n      const orgOverrides: OrgTypeAuthOverrides[] = [];\n      // AUTH-24: also detect whether ANY of the user's ACTIVE orgs is ACTIVELY directory-managed\n      // (DIRECTORY_PROVISIONING feature + a live SCIM token). If so, the effective policy must forbid\n      // local first-factor credentials (PASSWORD / PASSKEY / MAGIC_LINK / SMS_OTP — see\n      // `DIRECTORY_INCOMPATIBLE_LOCAL_AUTH_METHODS`) — they bypass the IdP and would\n      // survive deprovisioning. Because this resolves across ALL the user's orgs, ONE managed org disables\n      // them GLOBALLY for the user (the user-global closure); keying on CURRENT posture also covers a\n      // credential set before the org became managed (the activation window). See\n      // `.claude/plans/auth-24-credential-lifecycle.md`.\n      let anyDirectoryManaged = false;\n\n      for (const organizationId of activeOrgIds) {\n        try {\n          // System read: the org is one of the user's memberships resolved as system above, and may be a\n          // CROSS-org the login EC cannot see — so read it the same way. `ORGANIZATIONS` opts into\n          // `systemAccessPolicy.read`; the self-referential auth-policy resolution suppresses its own audit.\n          const org = await this.systemAccessService.readAsSystem<{ _id: string; type?: string }>(\n            CoreResourceType.ORGANIZATIONS, organizationId, { suppressSystemAudit: true },\n          );\n          if (org?.type && organizationTypes[org.type]?.authOverrides) {\n            orgOverrides.push(organizationTypes[org.type].authOverrides!);\n          }\n        } catch {\n          // Org read failure is non-fatal — skip this org's overrides\n        }\n        if (!anyDirectoryManaged) {\n          try {\n            const orgIsManaged = await isOrgActivelyDirectoryManaged({\n              organizationId,\n              featureResolution: this.featureResolution,\n              systemAccessService: this.systemAccessService,\n            });\n            // PROVISIONED-ONLY (user decision 2026-07-21): the derivation applies only to a user the IdP\n            // actually PROVISIONED — evidenced by a USER_IDENTITY_LINKS row for THIS org (written by the SCIM\n            // push / SSO-JIT). The owner/admin who joined via local registration/invite has NO link and keeps\n            // a break-glass credential. Aligns Part 1 with Part 3 (reconciliation only fires on the SCIM push,\n            // which also writes the link). See `.claude/plans/auth-24-credential-lifecycle.md`.\n            if (orgIsManaged) {\n              const identityLink = await this.systemAccessService.readAsSystem<{ _id: string }>(\n                CoreResourceType.USER_IDENTITY_LINKS, { userId, organizationId }, { suppressSystemAudit: true },\n              );\n              if (identityLink) anyDirectoryManaged = true;\n            }\n          } catch {\n            // Posture / identity-link read failure is non-fatal for THIS org — leave the flag as-is. Login\n            // must not hard-fail on a transient read; the invite-accept MUTATION path stays the fail-closed\n            // gate for credential CREATION, and reconciliation (AUTH-24 part 3) is the durable backstop.\n          }\n        }\n      }\n\n      // No overrides AND not directory-managed → nothing derived; return the raw user-type policy.\n      if (orgOverrides.length === 0 && !anyDirectoryManaged) return rawPolicy;\n\n      // Base effective config: org-merged (most-restrictive) when overrides exist, else the raw policy.\n      let effectiveMethods: AuthMethodsMap;\n      let effectiveMfa = rawPolicy.mfaPolicy;\n      let effectivePassword = rawPolicy.passwordPolicy;\n      if (orgOverrides.length > 0) {\n        const authConfig = this.appConfigService.config.auth;\n        const resolved = resolveAuthConfig({\n          userTypeAuth: rawPolicy,\n          orgOverrides,\n          orgAuthMethodPolicy: authConfig.orgAuthMethodPolicy,\n          expandableOrgMethods: authConfig.expandableOrgMethods,\n        });\n        effectiveMethods = resolved.authMethodsEnabled;\n        effectiveMfa = resolved.mfaPolicy;\n        effectivePassword = resolved.passwordPolicy;\n      } else {\n        effectiveMethods = rawPolicy.authMethodsEnabled as AuthMethodsMap;\n      }\n\n      // AUTH-24 derivation: posture wins over authored config (same most-restrictive direction as the\n      // org-override merge) — force the local first-factor methods OFF for a directory-managed user.\n      const authMethodsEnabled = anyDirectoryManaged\n        ? disableDirectoryIncompatibleMethods(effectiveMethods)\n        : effectiveMethods;\n\n      return {\n        ...rawPolicy,\n        authMethodsEnabled: authMethodsEnabled as UserTypeAuthPolicy['authMethodsEnabled'],\n        mfaPolicy: effectiveMfa,\n        passwordPolicy: effectivePassword,\n      };\n    } catch (error) {\n      this.logDebug('AUTH-14: Org override resolution failed, falling back to raw user-type policy', {\n        userId: userId.substring(0, 8) + '...',\n        userType,\n        ...projectCaughtErrorLogFields(error),\n      });\n      return rawPolicy;\n    }\n  }\n\n  /**\n   * Org-TYPE-keyed effective auth-policy resolution — PURE (no DB, no EC).\n   *\n   * For surfaces that must know an organization's available auth methods WITHOUT\n   * an authenticated user AND WITHOUT reading the ORGANIZATIONS resource. The\n   * canonical caller is the public invitation-accept screen, which runs under an\n   * unauthenticated `APP_PUBLIC` pre-auth EC that CANNOT read ORGANIZATIONS (its\n   * READ ACL is ORG_MEMBER / super-admin). An earlier org-ID-keyed variant read\n   * ORGANIZATIONS internally and fail-closed silently under that EC, dropping the\n   * org's auth overrides — so this takes the `orgType` the caller has already\n   * resolved via the system-access door and does zero I/O.\n   *\n   * Resolves the effective policy for a hypothetical member of `userType` in an\n   * organization of type `orgType`: `organizationTypes[orgType].authOverrides`\n   * merged through the SAME pure `resolveAuthConfig` core (most-restrictive-wins)\n   * used by the user-keyed path. Single-org, so no multi-org intersection — but the\n   * per-org RESTRICT_ONLY / EXPAND_WITHIN_SET / UNRESTRICTED policy still applies.\n   *\n   * Fail-open to the raw user-type policy when `orgType` is absent or its type\n   * declares no overrides. Returns `null` only when the user type has no policy at\n   * all (unknown user type).\n   */\n  resolveAuthPolicyForOrgType(\n    userType: string,\n    orgType: string | undefined,\n  ): UserTypeAuthPolicy | null {\n    return resolveAuthPolicyForOrganizationType(\n      this.appConfigService.config,\n      userType,\n      orgType,\n      this.appConfigService.getUserTypeAuthPolicy(userType),\n    );\n  }\n}\n"]}
+{"version":3,"file":"auth-user-lookup.backend.service.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/utils/auth-user-lookup.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAE7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,iBAAiB,EAAE,mCAAmC,EAAE,MAAM,uBAAuB,CAAC;AAE7H,OAAO,EAAE,6BAA6B,EAAE,MAAM,gFAAgF,CAAC;AAC/H,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAC3H,OAAO,EAAE,yBAAyB,EAAE,MAAM,+FAA+F,CAAC;AAK1I,OAAO,EACL,oCAAoC,GACrC,MAAM,wCAAwC,CAAC;AAEhD;;;;GAIG;AAEI,IAAM,4BAA4B,GAAlC,MAAM,4BAA4B;IAIe;IACwB;IACd;IAGQ;IACL;IATlD,QAAQ,CAA+D;IAExF,YACsD,MAAqB,EACG,uBAA8D,EAC5E,gBAAyC,EAGjC,iBAAkD,EACvD,mBAA+C;QAN5D,WAAM,GAAN,MAAM,CAAe;QACG,4BAAuB,GAAvB,uBAAuB,CAAuC;QAC5E,qBAAgB,GAAhB,gBAAgB,CAAyB;QAGjC,sBAAiB,GAAjB,iBAAiB,CAAiC;QACvD,wBAAmB,GAAnB,mBAAmB,CAA4B;QAEhH,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IAC3D,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe,CAAC,EAAyB,EAAE,KAAa;QAC5D,OAAO,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAO,gBAAgB,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IACxI,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,kBAAkB,CACtB,EAAyB,EACzB,KAAa,EACb,cAA+B;QAE/B,OAAO,IAAI,CAAC,uBAAuB,CAAC,IAAI,CACtC,gBAAgB,CAAC,KAAK,EACtB,EAAE,EACF,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,EAC9B,cAAc,CACf,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAAC,EAAyB,EAAE,MAAc;QAC1D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAiC,gBAAgB,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QAClI,OAAO,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,EAAyB,EAAE,MAAc;QAC1D,OAAO,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAO,gBAAgB,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,KAAK,CAAC,2BAA2B,CAAC,EAAyB,EAAE,MAAc;QACzE,OAAO,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAkB,gBAAgB,CAAC,gBAAgB,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/G,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,0BAA0B;IAC9B,iGAAiG;IACjG,kGAAkG;IAClG,mGAAmG;IACnG,GAA0B,EAC1B,MAAc,EACd,QAAgB;QAEhB,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACxE,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAE5B,IAAI,CAAC;YACH,wGAAwG;YACxG,yGAAyG;YACzG,wGAAwG;YACxG,0GAA0G;YAC1G,0GAA0G;YAC1G,wGAAwG;YACxG,sGAAsG;YACtG,MAAM,YAAY,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;YAEvF,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAC;YAEhD,MAAM,iBAAiB,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC;YAC/E,MAAM,YAAY,GAA2B,EAAE,CAAC;YAChD,2FAA2F;YAC3F,gGAAgG;YAChG,kFAAkF;YAClF,+EAA+E;YAC/E,qGAAqG;YACrG,gGAAgG;YAChG,4EAA4E;YAC5E,mDAAmD;YACnD,IAAI,mBAAmB,GAAG,KAAK,CAAC;YAEhC,KAAK,MAAM,cAAc,IAAI,YAAY,EAAE,CAAC;gBAC1C,IAAI,CAAC;oBACH,+FAA+F;oBAC/F,yFAAyF;oBACzF,mGAAmG;oBACnG,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,CACrD,gBAAgB,CAAC,aAAa,EAAE,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAC9E,CAAC;oBACF,IAAI,GAAG,EAAE,IAAI,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,CAAC;wBAC5D,YAAY,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,aAAc,CAAC,CAAC;oBAChE,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,4DAA4D;gBAC9D,CAAC;gBACD,IAAI,CAAC,mBAAmB,EAAE,CAAC;oBACzB,IAAI,CAAC;wBACH,MAAM,YAAY,GAAG,MAAM,6BAA6B,CAAC;4BACvD,cAAc;4BACd,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;4BACzC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;yBAC9C,CAAC,CAAC;wBACH,6FAA6F;wBAC7F,kGAAkG;wBAClG,kGAAkG;wBAClG,mGAAmG;wBACnG,oFAAoF;wBACpF,IAAI,YAAY,EAAE,CAAC;4BACjB,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAC9D,gBAAgB,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAChG,CAAC;4BACF,IAAI,YAAY;gCAAE,mBAAmB,GAAG,IAAI,CAAC;wBAC/C,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,+FAA+F;wBAC/F,gGAAgG;wBAChG,6FAA6F;oBAC/F,CAAC;gBACH,CAAC;YACH,CAAC;YAED,6FAA6F;YAC7F,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,mBAAmB;gBAAE,OAAO,SAAS,CAAC;YAExE,kGAAkG;YAClG,IAAI,gBAAgC,CAAC;YACrC,IAAI,YAAY,GAAG,SAAS,CAAC,SAAS,CAAC;YACvC,IAAI,iBAAiB,GAAG,SAAS,CAAC,cAAc,CAAC;YACjD,+FAA+F;YAC/F,8FAA8F;YAC9F,uBAAuB;YACvB,IAAI,eAAe,GAAG,SAAS,CAAC,UAAU,CAAC;YAC3C,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC;gBACrD,MAAM,QAAQ,GAAG,iBAAiB,CAAC;oBACjC,YAAY,EAAE,SAAS;oBACvB,YAAY;oBACZ,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;oBACnD,oBAAoB,EAAE,UAAU,CAAC,oBAAoB;iBACtD,CAAC,CAAC;gBACH,gBAAgB,GAAG,QAAQ,CAAC,kBAAkB,CAAC;gBAC/C,YAAY,GAAG,QAAQ,CAAC,SAAS,CAAC;gBAClC,iBAAiB,GAAG,QAAQ,CAAC,cAAc,CAAC;gBAC5C,eAAe,GAAG,QAAQ,CAAC,UAAU,CAAC;YACxC,CAAC;iBAAM,CAAC;gBACN,gBAAgB,GAAG,SAAS,CAAC,kBAAoC,CAAC;YACpE,CAAC;YAED,gGAAgG;YAChG,+FAA+F;YAC/F,MAAM,kBAAkB,GAAG,mBAAmB;gBAC5C,CAAC,CAAC,mCAAmC,CAAC,gBAAgB,CAAC;gBACvD,CAAC,CAAC,gBAAgB,CAAC;YAErB,OAAO;gBACL,GAAG,SAAS;gBACZ,kBAAkB,EAAE,kBAA8D;gBAClF,SAAS,EAAE,YAAY;gBACvB,cAAc,EAAE,iBAAiB;gBACjC,UAAU,EAAE,eAAe;aAC5B,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,QAAQ,CAAC,+EAA+E,EAAE;gBAC7F,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK;gBACtC,QAAQ;gBACR,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACtC,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,2BAA2B,CACzB,QAAgB,EAChB,OAA2B;QAE3B,OAAO,oCAAoC,CACzC,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAC5B,QAAQ,EACR,OAAO,EACP,IAAI,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CACtD,CAAC;IACJ,CAAC;CACF,CAAA;AAtOY,4BAA4B;IADxC,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAG3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,CAAA;IACnD,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;qCANa,aAAa,YAEO,uBAAuB;GAN9F,4BAA4B,CAsOxC","sourcesContent":["import 'reflect-metadata';\nimport { injectable, inject } from 'inversify';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport type { ServicesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/services/services-registry-handler.backend.service';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { CoreResourceType, UserStatus, resolveAuthConfig, disableDirectoryIncompatibleMethods } from '@wildo-ai/saas-models';\nimport type { User, UserPreferences, UserTypeAuthPolicy, OrgTypeAuthOverrides, AuthMethodsMap } from '@wildo-ai/saas-models';\nimport { isOrgActivelyDirectoryManaged } from '~wildo-backend-lib/organizations/services/scim-provisioning-gate.backend.utils';\nimport { projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { resolveActiveMemberOrgIds } from '~wildo-backend-lib/security/authentications/services/resolve-active-member-orgs.backend.utils';\nimport type { FeatureResolutionBackendService } from '~wildo-backend-lib/features/services/feature-resolution.backend.service';\nimport type { SystemAccessBackendService } from '~wildo-backend-lib/base-classes/services/services/system-access.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport type { ServiceOptions } from '~wildo-backend-lib/base-classes/models/repositories.backend.schemas';\nimport {\n  resolveAuthPolicyForOrganizationType,\n} from './auth-policy-resolution.backend.utils';\n\n/**\n * User lookup helpers extracted from controller private methods.\n * Provides email-based lookups for Users and effective auth policy resolution\n * with org override merging (W5.8 / AUTH-14).\n */\n@injectable()\nexport class AuthUserLookupBackendService {\n  private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.ServicesRegistryHandlerService) private readonly servicesRegistryHandler: ServicesRegistryHandlerBackendService,\n    @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n    // AUTH-24: resolve per-org directory-management posture (DIRECTORY_PROVISIONING feature + a live SCIM\n    // token) to derive local first-factor credential methods OFF the effective policy for a managed user.\n    @inject(SAAS_SERVICE_TYPES.FeatureResolutionService) private readonly featureResolution: FeatureResolutionBackendService,\n    @inject(SAAS_SERVICE_TYPES.SystemAccessService) private readonly systemAccessService: SystemAccessBackendService,\n  ) {\n    this.logDebug = this.logger.debugByType('AuthUserLookup');\n    this.logger.setDebugTypeLogging('AuthUserLookup', false);\n  }\n\n  /**\n   * Find a user by email address (ACTIVE only).\n   * Returns null if not found — used by password reset which must not leak info.\n   */\n  async findUserByEmail(ec: ExecutionContext<any>, email: string): Promise<User | null> {\n    return this.servicesRegistryHandler.read<User>(CoreResourceType.USERS, ec, { email: email.toLowerCase(), status: UserStatus.ACTIVE });\n  }\n\n  /**\n   * Find a user by email address (any status).\n   * Used by registration to check email uniqueness across ALL statuses.\n   */\n  async findAnyUserByEmail(\n    ec: ExecutionContext<any>,\n    email: string,\n    serviceOptions?: ServiceOptions,\n  ): Promise<User | null> {\n    return this.servicesRegistryHandler.read<User>(\n      CoreResourceType.USERS,\n      ec,\n      { email: email.toLowerCase() },\n      serviceOptions,\n    );\n  }\n\n  /**\n   * Look up a user's email for audit/display purposes.\n   * Returns empty string if not found.\n   */\n  async getUserEmail(ec: ExecutionContext<any>, userId: string): Promise<string> {\n    const user = await this.servicesRegistryHandler.read<{ _id: string; email: string }>(CoreResourceType.USERS, ec, { _id: userId });\n    return user?.email ?? '';\n  }\n\n  async findUserById(ec: ExecutionContext<any>, userId: string): Promise<User | null> {\n    return this.servicesRegistryHandler.read<User>(CoreResourceType.USERS, ec, { _id: userId });\n  }\n\n  async findUserPreferencesByUserId(ec: ExecutionContext<any>, userId: string): Promise<UserPreferences | null> {\n    return this.servicesRegistryHandler.read<UserPreferences>(CoreResourceType.USER_PREFERENCES, ec, { userId });\n  }\n\n  /**\n   * AUTH-14 / W5.8: Resolve effective auth policy with org override merging.\n   *\n   * 1. Gets the raw UserTypeAuthPolicy from config\n   * 2. Fetches user's active org memberships\n   * 3. For each org, reads the org to get its type\n   * 4. Collects authOverrides from organizationTypes[orgType]\n   * 5. Calls resolveAuthConfig to merge (most-restrictive-wins)\n   * 6. Returns the full UserTypeAuthPolicy with overridable fields merged\n   *\n   * Fields affected by org overrides: authMethodsEnabled, mfaPolicy, passwordPolicy.\n   * All other fields (sessionDurationMinutes, lockoutPolicy, registration, etc.)\n   * come from the raw user-type policy unchanged.\n   */\n  async resolveEffectiveAuthPolicy(\n    // `_ec` is intentionally unused: AUTH-24 moved membership/org/link resolution to the SYSTEM door\n    // (see the body), which builds its own context — a login/session EC carries no trusted org scope.\n    // Kept in the signature for call-site stability and parity with the other lookups on this service.\n    _ec: ExecutionContext<any>,\n    userId: string,\n    userType: string,\n  ): Promise<UserTypeAuthPolicy | null> {\n    const rawPolicy = this.appConfigService.getUserTypeAuthPolicy(userType);\n    if (!rawPolicy) return null;\n\n    try {\n      // Resolve the user's ACTIVE org memberships via the SYSTEM door, NOT an ec-scoped read. A login/session\n      // is globally org-agnostic and its EC carries NO trusted org scope, so an ec-scoped ORGANIZATION_MEMBERS\n      // list surfaces only the user's PRIMARY-org membership and silently MISSES a CROSS-org membership (e.g.\n      // one a SCIM push just added) — which would defeat the user-global closure below (a user password-logs-in\n      // fine because the resolver never sees the managed org they were just provisioned into). See the incident\n      // note in `resolveActiveMemberOrgIds` — the same reason per-org audit routing must read the junction as\n      // system. That canonical resolver (`listAsSystem`, self-referential audit suppressed) is reused here.\n      const activeOrgIds = await resolveActiveMemberOrgIds(this.systemAccessService, userId);\n\n      if (activeOrgIds.length === 0) return rawPolicy;\n\n      const organizationTypes = this.appConfigService.config.organizationTypes ?? {};\n      const orgOverrides: OrgTypeAuthOverrides[] = [];\n      // AUTH-24: also detect whether ANY of the user's ACTIVE orgs is ACTIVELY directory-managed\n      // (DIRECTORY_PROVISIONING feature + a live SCIM token). If so, the effective policy must forbid\n      // local first-factor credentials (PASSWORD / PASSKEY / MAGIC_LINK / SMS_OTP — see\n      // `DIRECTORY_INCOMPATIBLE_LOCAL_AUTH_METHODS`) — they bypass the IdP and would\n      // survive deprovisioning. Because this resolves across ALL the user's orgs, ONE managed org disables\n      // them GLOBALLY for the user (the user-global closure); keying on CURRENT posture also covers a\n      // credential set before the org became managed (the activation window). See\n      // `.claude/plans/auth-24-credential-lifecycle.md`.\n      let anyDirectoryManaged = false;\n\n      for (const organizationId of activeOrgIds) {\n        try {\n          // System read: the org is one of the user's memberships resolved as system above, and may be a\n          // CROSS-org the login EC cannot see — so read it the same way. `ORGANIZATIONS` opts into\n          // `systemAccessPolicy.read`; the self-referential auth-policy resolution suppresses its own audit.\n          const org = await this.systemAccessService.readAsSystem<{ _id: string; type?: string }>(\n            CoreResourceType.ORGANIZATIONS, organizationId, { suppressSystemAudit: true },\n          );\n          if (org?.type && organizationTypes[org.type]?.authOverrides) {\n            orgOverrides.push(organizationTypes[org.type].authOverrides!);\n          }\n        } catch {\n          // Org read failure is non-fatal — skip this org's overrides\n        }\n        if (!anyDirectoryManaged) {\n          try {\n            const orgIsManaged = await isOrgActivelyDirectoryManaged({\n              organizationId,\n              featureResolution: this.featureResolution,\n              systemAccessService: this.systemAccessService,\n            });\n            // PROVISIONED-ONLY (user decision 2026-07-21): the derivation applies only to a user the IdP\n            // actually PROVISIONED — evidenced by a USER_IDENTITY_LINKS row for THIS org (written by the SCIM\n            // push / SSO-JIT). The owner/admin who joined via local registration/invite has NO link and keeps\n            // a break-glass credential. Aligns Part 1 with Part 3 (reconciliation only fires on the SCIM push,\n            // which also writes the link). See `.claude/plans/auth-24-credential-lifecycle.md`.\n            if (orgIsManaged) {\n              const identityLink = await this.systemAccessService.readAsSystem<{ _id: string }>(\n                CoreResourceType.USER_IDENTITY_LINKS, { userId, organizationId }, { suppressSystemAudit: true },\n              );\n              if (identityLink) anyDirectoryManaged = true;\n            }\n          } catch {\n            // Posture / identity-link read failure is non-fatal for THIS org — leave the flag as-is. Login\n            // must not hard-fail on a transient read; the invite-accept MUTATION path stays the fail-closed\n            // gate for credential CREATION, and reconciliation (AUTH-24 part 3) is the durable backstop.\n          }\n        }\n      }\n\n      // No overrides AND not directory-managed → nothing derived; return the raw user-type policy.\n      if (orgOverrides.length === 0 && !anyDirectoryManaged) return rawPolicy;\n\n      // Base effective config: org-merged (most-restrictive) when overrides exist, else the raw policy.\n      let effectiveMethods: AuthMethodsMap;\n      let effectiveMfa = rawPolicy.mfaPolicy;\n      let effectivePassword = rawPolicy.passwordPolicy;\n      // #527 — the fourth overridable axis. Declared beside its three siblings because this resolver\n      // and the pure org-type one are TWO sites of one invariant, and the merge must not be applied\n      // at only one of them.\n      let effectiveStepUp = rawPolicy.stepUpAuth;\n      if (orgOverrides.length > 0) {\n        const authConfig = this.appConfigService.config.auth;\n        const resolved = resolveAuthConfig({\n          userTypeAuth: rawPolicy,\n          orgOverrides,\n          orgAuthMethodPolicy: authConfig.orgAuthMethodPolicy,\n          expandableOrgMethods: authConfig.expandableOrgMethods,\n        });\n        effectiveMethods = resolved.authMethodsEnabled;\n        effectiveMfa = resolved.mfaPolicy;\n        effectivePassword = resolved.passwordPolicy;\n        effectiveStepUp = resolved.stepUpAuth;\n      } else {\n        effectiveMethods = rawPolicy.authMethodsEnabled as AuthMethodsMap;\n      }\n\n      // AUTH-24 derivation: posture wins over authored config (same most-restrictive direction as the\n      // org-override merge) — force the local first-factor methods OFF for a directory-managed user.\n      const authMethodsEnabled = anyDirectoryManaged\n        ? disableDirectoryIncompatibleMethods(effectiveMethods)\n        : effectiveMethods;\n\n      return {\n        ...rawPolicy,\n        authMethodsEnabled: authMethodsEnabled as UserTypeAuthPolicy['authMethodsEnabled'],\n        mfaPolicy: effectiveMfa,\n        passwordPolicy: effectivePassword,\n        stepUpAuth: effectiveStepUp,\n      };\n    } catch (error) {\n      this.logDebug('AUTH-14: Org override resolution failed, falling back to raw user-type policy', {\n        userId: userId.substring(0, 8) + '...',\n        userType,\n        ...projectCaughtErrorLogFields(error),\n      });\n      return rawPolicy;\n    }\n  }\n\n  /**\n   * Org-TYPE-keyed effective auth-policy resolution — PURE (no DB, no EC).\n   *\n   * For surfaces that must know an organization's available auth methods WITHOUT\n   * an authenticated user AND WITHOUT reading the ORGANIZATIONS resource. The\n   * canonical caller is the public invitation-accept screen, which runs under an\n   * unauthenticated `APP_PUBLIC` pre-auth EC that CANNOT read ORGANIZATIONS (its\n   * READ ACL is ORG_MEMBER / super-admin). An earlier org-ID-keyed variant read\n   * ORGANIZATIONS internally and fail-closed silently under that EC, dropping the\n   * org's auth overrides — so this takes the `orgType` the caller has already\n   * resolved via the system-access door and does zero I/O.\n   *\n   * Resolves the effective policy for a hypothetical member of `userType` in an\n   * organization of type `orgType`: `organizationTypes[orgType].authOverrides`\n   * merged through the SAME pure `resolveAuthConfig` core (most-restrictive-wins)\n   * used by the user-keyed path. Single-org, so no multi-org intersection — but the\n   * per-org RESTRICT_ONLY / EXPAND_WITHIN_SET / UNRESTRICTED policy still applies.\n   *\n   * Fail-open to the raw user-type policy when `orgType` is absent or its type\n   * declares no overrides. Returns `null` only when the user type has no policy at\n   * all (unknown user type).\n   */\n  resolveAuthPolicyForOrgType(\n    userType: string,\n    orgType: string | undefined,\n  ): UserTypeAuthPolicy | null {\n    return resolveAuthPolicyForOrganizationType(\n      this.appConfigService.config,\n      userType,\n      orgType,\n      this.appConfigService.getUserTypeAuthPolicy(userType),\n    );\n  }\n}\n"]}

package/dist/esm/security/authentications/services/utils/concurrent-session-eviction.backend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"concurrent-session-eviction.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/utils/concurrent-session-eviction.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,IAAI,MAAM,CAElD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAIlG;AAQD,qGAAqG;AACrG,eAAO,MAAM,qCAAqC,KAAK,CAAC;AAExD;;;;;;GAMG;AACH,wBAAgB,iCAAiC,CAAC,MAAM,EAAE;IACxD,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IACtC,eAAe,EAAE,MAAM,CAAC;IACxB,sBAAsB,EAAE,MAAM,CAAC;CAChC,GAAG,MAAM,CAST;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,+BAA+B,mvBAsBvC,CAAC"}
+{"version":3,"file":"concurrent-session-eviction.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/utils/concurrent-session-eviction.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,IAAI,MAAM,CAElD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAIlG;AAQD,qGAAqG;AACrG,eAAO,MAAM,qCAAqC,KAAK,CAAC;AAExD;;;;;;GAMG;AACH,wBAAgB,iCAAiC,CAAC,MAAM,EAAE;IACxD,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IACtC,eAAe,EAAE,MAAM,CAAC;IACxB,sBAAsB,EAAE,MAAM,CAAC;CAChC,GAAG,MAAM,CAST;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,+BAA+B,mvBAsBvC,CAAC"}

package/dist/esm/security/authentications/services/utils/ensure-user-profile.backend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ensure-user-profile.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/utils/ensure-user-profile.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAC5G,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AACzJ,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAElI;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,wBAAsB,oCAAoC,CACxD,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE;IACN,oFAAoF;IACpF,MAAM,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,OAAO,EAAE,wBAAwB,CAAC;IAClC,uBAAuB,EAAE,qCAAqC,CAAC;IAC/D,mBAAmB,EAAE,0BAA0B,CAAC;IAChD;;;;OAIG;IACH,MAAM,EAAE,aAAa,CAAC;CACvB,GACA,OAAO,CAAC,IAAI,CAAC,CAoDf"}
+{"version":3,"file":"ensure-user-profile.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/utils/ensure-user-profile.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAC5G,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AACzJ,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAElI;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,wBAAsB,oCAAoC,CACxD,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE;IACN,oFAAoF;IACpF,MAAM,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,OAAO,EAAE,wBAAwB,CAAC;IAClC,uBAAuB,EAAE,qCAAqC,CAAC;IAC/D,mBAAmB,EAAE,0BAA0B,CAAC;IAChD;;;;OAIG;IACH,MAAM,EAAE,aAAa,CAAC;CACvB,GACA,OAAO,CAAC,IAAI,CAAC,CAoDf"}

package/dist/esm/security/authentications/services/utils/external-turn-rate-limit.backend.utils.d.ts

@@ -1,4 +1,4 @@
-import type { ResourceServerKind, RuntimeEnvironment } from '@wildo-ai/saas-models';
+import type { ExecutionContext_InitiatorIds, ResourceServerKind, RuntimeEnvironment } from '@wildo-ai/saas-models';
 import type { RedisService } from '../../../../databases/services/redis.service';
 import type { LoggerService } from '../../../../monitoring/logger/services/logger.service';
 import type { SocketAuthResult } from '../../../../runtime/models/execution-context.backend.schemas';
@@ -68,6 +68,42 @@ export type ExternalTurnRateDecision = {
  * owner id, so the caller treats `undefined` as "cannot throttle → proceed", fail-open).
  */
 export declare function resolvePrincipalRateKey(auth: SocketAuthResult): string | undefined;
+/**
+ * Derive the counting subject for an operation's OWN declared `rateLimit` policy on a
+ * credentialed agent plane (today: MCP `tools/call`). Sits beside
+ * {@link resolvePrincipalRateKey} on purpose — the two answer the same question for two
+ * different guards, and the ONE thing a reader must not have to reconstruct is why they
+ * answer it differently.
+ *
+ * ## The precedence differs from {@link resolvePrincipalRateKey}, and that is the decision
+ *
+ * `resolvePrincipalRateKey` deliberately keys the framework's blanket abuse throttle on the
+ * principal's OWNER (`user` → `org` → `app`). That is right for a spend guard: the thing being
+ * protected is the tenant's shared upstream quota, so every credential the tenant issued should
+ * saturate ONE bucket and a tenant cannot buy more headroom by minting more clients.
+ *
+ * An AUTHORED per-endpoint `rateLimit` is a different statement. Over HTTP it is enforced
+ * per SOURCE IP — one caller, one budget — so `requestsPerMinute: 5` has never meant "5/min
+ * for the whole tenant"; it means "5/min per client, and N clients get N × 5". The faithful
+ * translation onto a plane whose callers are credentials rather than sockets is therefore the
+ * CREDENTIAL: two agents an organization runs against the same tool are two clients, exactly as
+ * two browsers on two IPs are. Keying this guard on the org instead would silently make the
+ * SAME declared number roughly N times stricter over MCP than over REST for any tenant running
+ * more than one agent — the "throttles a whole tenant on one agent's traffic" failure — and an
+ * application author reading `requestsPerMinute: 5` has no way to discover that.
+ *
+ * Hence: credential first, then the delegated user, then the owning scope as a last resort.
+ * The scope fallback is defensive only — an authenticated MCP caller is either a machine (which
+ * always carries `machineCredential`) or user-delegated (which always carries `userId`).
+ *
+ * Every branch reads a SERVER-VERIFIED field of the execution context. Nothing here may ever be
+ * sourced from tool arguments or any other model-supplied value, or the throttle becomes
+ * opt-out by an attacker choosing a fresh bucket per call.
+ *
+ * @returns `undefined` when no identity field is present (see the call site for what that means
+ *   there — this function does not decide the posture, it only reports that it cannot key).
+ */
+export declare function resolveDeclaredPolicySubjectKey(initiatorIds: ExecutionContext_InitiatorIds | null | undefined): string | undefined;
 /**
  * Increment and evaluate the per-principal counter for one external turn/call. Call this
  * AFTER authentication and BEFORE the expensive dispatch (LLM turn / resource op). Returns

package/dist/esm/security/authentications/services/utils/external-turn-rate-limit.backend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"external-turn-rate-limit.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/utils/external-turn-rate-limit.backend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACxF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAI5G;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,8GAA8G;AAC9G,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAC7C,mEAAmE;AACnE,eAAO,MAAM,qCAAqC,KAAK,CAAC;AAExD,4FAA4F;AAC5F,eAAO,MAAM,0BAA0B,MAAM,CAAC;AAC9C,mEAAmE;AACnE,eAAO,MAAM,qCAAqC,KAAK,CAAC;AAExD;;;;;;;GAOG;AACH,MAAM,MAAM,wBAAwB,GAChC;IAAE,IAAI,EAAE,IAAI,CAAA;CAAE,GACd;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,CAAC;AAExD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM,GAAG,SAAS,CAOlF;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,4BAA4B,CAChD,IAAI,EAAE;IAAE,YAAY,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,EAC3D,MAAM,EAAE;IACN,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,kBAAkB,CAAC;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,kBAAkB,CAAC;CACpC,GACA,OAAO,CAAC,wBAAwB,CAAC,CA2BnC"}
+{"version":3,"file":"external-turn-rate-limit.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/utils/external-turn-rate-limit.backend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,6BAA6B,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AACnH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACxF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAI5G;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,8GAA8G;AAC9G,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAC7C,mEAAmE;AACnE,eAAO,MAAM,qCAAqC,KAAK,CAAC;AAExD,4FAA4F;AAC5F,eAAO,MAAM,0BAA0B,MAAM,CAAC;AAC9C,mEAAmE;AACnE,eAAO,MAAM,qCAAqC,KAAK,CAAC;AAExD;;;;;;;GAOG;AACH,MAAM,MAAM,wBAAwB,GAChC;IAAE,IAAI,EAAE,IAAI,CAAA;CAAE,GACd;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,CAAC;AAExD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM,GAAG,SAAS,CAOlF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,+BAA+B,CAAC,YAAY,EAAE,6BAA6B,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAUlI;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,4BAA4B,CAChD,IAAI,EAAE;IAAE,YAAY,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,EAC3D,MAAM,EAAE;IACN,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,kBAAkB,CAAC;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,kBAAkB,CAAC;CACpC,GACA,OAAO,CAAC,wBAAwB,CAAC,CA2BnC"}

package/dist/esm/security/authentications/services/utils/external-turn-rate-limit.backend.utils.js

@@ -63,6 +63,57 @@ export function resolvePrincipalRateKey(auth) {
         return `app:${ids.applicationId}`;
     return undefined;
 }
+/**
+ * Derive the counting subject for an operation's OWN declared `rateLimit` policy on a
+ * credentialed agent plane (today: MCP `tools/call`). Sits beside
+ * {@link resolvePrincipalRateKey} on purpose — the two answer the same question for two
+ * different guards, and the ONE thing a reader must not have to reconstruct is why they
+ * answer it differently.
+ *
+ * ## The precedence differs from {@link resolvePrincipalRateKey}, and that is the decision
+ *
+ * `resolvePrincipalRateKey` deliberately keys the framework's blanket abuse throttle on the
+ * principal's OWNER (`user` → `org` → `app`). That is right for a spend guard: the thing being
+ * protected is the tenant's shared upstream quota, so every credential the tenant issued should
+ * saturate ONE bucket and a tenant cannot buy more headroom by minting more clients.
+ *
+ * An AUTHORED per-endpoint `rateLimit` is a different statement. Over HTTP it is enforced
+ * per SOURCE IP — one caller, one budget — so `requestsPerMinute: 5` has never meant "5/min
+ * for the whole tenant"; it means "5/min per client, and N clients get N × 5". The faithful
+ * translation onto a plane whose callers are credentials rather than sockets is therefore the
+ * CREDENTIAL: two agents an organization runs against the same tool are two clients, exactly as
+ * two browsers on two IPs are. Keying this guard on the org instead would silently make the
+ * SAME declared number roughly N times stricter over MCP than over REST for any tenant running
+ * more than one agent — the "throttles a whole tenant on one agent's traffic" failure — and an
+ * application author reading `requestsPerMinute: 5` has no way to discover that.
+ *
+ * Hence: credential first, then the delegated user, then the owning scope as a last resort.
+ * The scope fallback is defensive only — an authenticated MCP caller is either a machine (which
+ * always carries `machineCredential`) or user-delegated (which always carries `userId`).
+ *
+ * Every branch reads a SERVER-VERIFIED field of the execution context. Nothing here may ever be
+ * sourced from tool arguments or any other model-supplied value, or the throttle becomes
+ * opt-out by an attacker choosing a fresh bucket per call.
+ *
+ * @returns `undefined` when no identity field is present (see the call site for what that means
+ *   there — this function does not decide the posture, it only reports that it cannot key).
+ */
+export function resolveDeclaredPolicySubjectKey(initiatorIds) {
+    if (!initiatorIds)
+        return undefined;
+    const credential = initiatorIds.machineCredential;
+    // The auth method rides the key because the two credential kinds are separate id spaces
+    // (an ApiKey row id and an OAuthClient row id could collide) — never as a policy axis.
+    if (credential?.credentialId)
+        return `cred:${credential.authMethod}:${credential.credentialId}`;
+    if (initiatorIds.userId)
+        return `user:${initiatorIds.userId}`;
+    if (initiatorIds.organizationId)
+        return `org:${initiatorIds.organizationId}`;
+    if (initiatorIds.applicationId)
+        return `app:${initiatorIds.applicationId}`;
+    return undefined;
+}
 /**
  * Increment and evaluate the per-principal counter for one external turn/call. Call this
  * AFTER authentication and BEFORE the expensive dispatch (LLM turn / resource op). Returns

package/dist/esm/security/authentications/services/utils/external-turn-rate-limit.backend.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"external-turn-rate-limit.backend.utils.js","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/utils/external-turn-rate-limit.backend.utils.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAC3H,OAAO,EAAE,mCAAmC,EAAE,MAAM,iFAAiF,CAAC;AAEtI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,8GAA8G;AAC9G,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAC7C,mEAAmE;AACnE,MAAM,CAAC,MAAM,qCAAqC,GAAG,EAAE,CAAC;AAExD,4FAA4F;AAC5F,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAC9C,mEAAmE;AACnE,MAAM,CAAC,MAAM,qCAAqC,GAAG,EAAE,CAAC;AAcxD;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAsB;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC;IAC9B,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,IAAI,GAAG,CAAC,MAAM;QAAE,OAAO,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;IAC5C,IAAI,GAAG,CAAC,cAAc;QAAE,OAAO,OAAO,GAAG,CAAC,cAAc,EAAE,CAAC;IAC3D,IAAI,GAAG,CAAC,aAAa;QAAE,OAAO,OAAO,GAAG,CAAC,aAAa,EAAE,CAAC;IACzD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,IAA2D,EAC3D,MAMC;IAED,MAAM,UAAU,GAAG,iBAAiB,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;IACnF,MAAM,qBAAqB,GAAG,mCAAmC,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;IAC9G,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;QAC3F,IAAI,KAAK,GAAG,qBAAqB,EAAE,CAAC;YAClC,mFAAmF;YACnF,IAAI,iBAAiB,GAAG,MAAM,CAAC,aAAa,CAAC;YAC7C,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;gBAChE,IAAI,GAAG,GAAG,CAAC;oBAAE,iBAAiB,GAAG,GAAG,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,uFAAuF;YACzF,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,iBAAiB,EAAE,CAAC;QACrD,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,iFAAiF;QACjF,iFAAiF;QACjF,kDAAkD;QAClD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iGAAiG,EAAE;YAClH,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,GAAG,2BAA2B,CAAC,KAAK,CAAC;SACtC,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC;AACH,CAAC","sourcesContent":["import type { ResourceServerKind, RuntimeEnvironment } from '@wildo-ai/saas-models';\nimport type { RedisService } from '~wildo-backend-lib/databases/services/redis.service';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport type { SocketAuthResult } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport { projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { relaxAbuseThrottleMaxForEnvironment } from '~wildo-backend-lib/errors/utils/rate-limit-environment-relaxation.backend.utils';\n\n/**\n * Per-PRINCIPAL success-path throttle for the external agent transports (A2A / MCP).\n *\n * ## Why this exists, and how it differs from the auth guard next door\n *\n * `machine-auth-rate-limit.backend.utils.ts` is a **failure-keyed** brute-force guard —\n * it only counts REJECTED secret/token presentations, keyed on the source IP, and it\n * deliberately does NOT throttle a valid token (a signature-gated token cannot be\n * guessed). That leaves a real exposure this util closes: an authenticated caller\n * holding ONE valid credential can drive UNBOUNDED work on the credentialed endpoints —\n * for A2A, unbounded LLM turns (direct spend + noisy-neighbor exhaustion of the app's\n * shared upstream model quota); for MCP, unbounded resource-operation dispatch (DB load).\n * There is no app-level global HTTP limiter on these routes, so the only cap is the one\n * added here.\n *\n * This guard is therefore the mirror image of the auth guard:\n * - **Success-keyed, per PRINCIPAL** — every ACCEPTED turn/call increments a counter keyed\n *   on the authenticated principal (`userId` \\| `organizationId` \\| `applicationId`), never\n *   on a caller/LLM-supplied value. Keying on the principal (not the IP) caps the actual\n *   spend axis: the credential. (The FAILURE path already feeds a per-IP counter.)\n * - **Fixed window, increment-then-compare** — the Nth call's atomic `INCR` returns N; once\n *   N exceeds the cap the caller is throttled for the remainder of the window. A throttled\n *   attempt still consumed its `INCR`, which is intentional: a burst of rejected attempts\n *   keeps the abuser saturated rather than clearing the window.\n * - **Fails OPEN on a limiter outage** — a Redis failure must never break the external\n *   endpoint. This is an ABUSE-throttle, not a billing boundary; consistency with the\n *   sibling auth limiter. (The future per-tenant SPEND budget is a billing boundary and\n *   will fail CLOSED instead — do not copy this fail-open policy there.)\n *\n * ## Distinct caps per surface (semantic precision)\n *\n * A2A `message/send` runs an LLM agent turn; MCP `tools/call` dispatches a CRUD resource\n * operation — NOT an LLM call. Their abuse profiles differ (model spend vs DB load), so the\n * two surfaces carry distinct caps rather than one merged number. All caps are framework\n * defaults, tunable later (a per-tenant budget / app-config surface is the follow-on).\n */\n\n/** Max A2A agent turns (`message/send` + `message/stream`) per principal per window (LLM spend — tighter). */\nexport const A2A_EXTERNAL_TURN_RATE_MAX = 30;\n/** Rolling window (seconds) for the A2A per-principal turn cap. */\nexport const A2A_EXTERNAL_TURN_RATE_WINDOW_SECONDS = 60;\n\n/** Max MCP `tools/call` dispatches per principal per window (resource-op load — looser). */\nexport const MCP_EXTERNAL_CALL_RATE_MAX = 120;\n/** Rolling window (seconds) for the MCP per-principal call cap. */\nexport const MCP_EXTERNAL_CALL_RATE_WINDOW_SECONDS = 60;\n\n/**\n * Outcome of a per-principal throttle check. STRING discriminant (`kind`) because this\n * package compiles with `strictNullChecks` off, under which boolean-literal discriminated\n * unions do not narrow reliably (same rationale as the A2A/MCP transport result types).\n * Returned rather than thrown so the caller can emit a controlled transport response\n * (HTTP 429 + `Retry-After`) instead of routing a `RATE_LIMIT` error through the generic\n * async error handler.\n */\nexport type ExternalTurnRateDecision =\n  | { kind: 'ok' }\n  | { kind: 'rate_limited'; retryAfterSeconds: number };\n\n/**\n * Derive the stable throttle key for an authenticated principal from its server-verified\n * identity. A user-delegated principal carries a `userId`; a machine principal carries\n * exactly one of `organizationId` / `applicationId`. Returns `undefined` for an unkeyable\n * principal (defensive — auth already fails closed for a principal with no resolvable\n * owner id, so the caller treats `undefined` as \"cannot throttle → proceed\", fail-open).\n */\nexport function resolvePrincipalRateKey(auth: SocketAuthResult): string | undefined {\n  const ids = auth.initiatorIds;\n  if (!ids) return undefined;\n  if (ids.userId) return `user:${ids.userId}`;\n  if (ids.organizationId) return `org:${ids.organizationId}`;\n  if (ids.applicationId) return `app:${ids.applicationId}`;\n  return undefined;\n}\n\n/**\n * Increment and evaluate the per-principal counter for one external turn/call. Call this\n * AFTER authentication and BEFORE the expensive dispatch (LLM turn / resource op). Returns\n * `{ kind: 'rate_limited', retryAfterSeconds }` once the principal exceeds `maxPerWindow`\n * in the window, otherwise `{ kind: 'ok' }`. Fails OPEN (returns `ok`) on any Redis error.\n *\n * `params.applicationEnv` scales `maxPerWindow` in DEVELOPMENT/TEST through the shared\n * relaxation seam, so an e2e suite driving many A2A turns or MCP calls under one\n * provisioned principal is not throttled by a production-authored spend guard.\n * `STAGING`/`PRODUCTION` enforce the caller's number exactly.\n */\nexport async function assertExternalTurnWithinRate(\n  deps: { redisService: RedisService; logger: LoggerService },\n  params: {\n    principalKey: string;\n    resourceServer: ResourceServerKind;\n    maxPerWindow: number;\n    windowSeconds: number;\n    applicationEnv: RuntimeEnvironment;\n  },\n): Promise<ExternalTurnRateDecision> {\n  const identifier = `external_turn:${params.resourceServer}:${params.principalKey}`;\n  const effectiveMaxPerWindow = relaxAbuseThrottleMaxForEnvironment(params.maxPerWindow, params.applicationEnv);\n  try {\n    const count = await deps.redisService.incrementRateLimit(identifier, params.windowSeconds);\n    if (count > effectiveMaxPerWindow) {\n      // Prefer the live TTL for an accurate `Retry-After`; fall back to the full window.\n      let retryAfterSeconds = params.windowSeconds;\n      try {\n        const ttl = await deps.redisService.getRateLimitTtl(identifier);\n        if (ttl > 0) retryAfterSeconds = ttl;\n      } catch {\n        // Keep the window fallback — a TTL read failure must not upgrade this to a hard error.\n      }\n      return { kind: 'rate_limited', retryAfterSeconds };\n    }\n    return { kind: 'ok' };\n  } catch (error) {\n    // Fail OPEN: a limiter outage must never break the external endpoint. This is an\n    // abuse-throttle, not a billing boundary — the per-tenant spend budget (a later,\n    // separate concern) is the one that fails closed.\n    deps.logger.warn('[external-turn-rate-limit] throttle check skipped (rate-limit store unavailable) — failing open', {\n      resourceServer: params.resourceServer,\n      ...projectCaughtErrorLogFields(error),\n    });\n    return { kind: 'ok' };\n  }\n}\n"]}
+{"version":3,"file":"external-turn-rate-limit.backend.utils.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/utils/external-turn-rate-limit.backend.utils.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAC3H,OAAO,EAAE,mCAAmC,EAAE,MAAM,iFAAiF,CAAC;AAEtI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,8GAA8G;AAC9G,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAC7C,mEAAmE;AACnE,MAAM,CAAC,MAAM,qCAAqC,GAAG,EAAE,CAAC;AAExD,4FAA4F;AAC5F,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAC9C,mEAAmE;AACnE,MAAM,CAAC,MAAM,qCAAqC,GAAG,EAAE,CAAC;AAcxD;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAsB;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC;IAC9B,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,IAAI,GAAG,CAAC,MAAM;QAAE,OAAO,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;IAC5C,IAAI,GAAG,CAAC,cAAc;QAAE,OAAO,OAAO,GAAG,CAAC,cAAc,EAAE,CAAC;IAC3D,IAAI,GAAG,CAAC,aAAa;QAAE,OAAO,OAAO,GAAG,CAAC,aAAa,EAAE,CAAC;IACzD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,UAAU,+BAA+B,CAAC,YAA8D;IAC5G,IAAI,CAAC,YAAY;QAAE,OAAO,SAAS,CAAC;IACpC,MAAM,UAAU,GAAG,YAAY,CAAC,iBAAiB,CAAC;IAClD,wFAAwF;IACxF,uFAAuF;IACvF,IAAI,UAAU,EAAE,YAAY;QAAE,OAAO,QAAQ,UAAU,CAAC,UAAU,IAAI,UAAU,CAAC,YAAY,EAAE,CAAC;IAChG,IAAI,YAAY,CAAC,MAAM;QAAE,OAAO,QAAQ,YAAY,CAAC,MAAM,EAAE,CAAC;IAC9D,IAAI,YAAY,CAAC,cAAc;QAAE,OAAO,OAAO,YAAY,CAAC,cAAc,EAAE,CAAC;IAC7E,IAAI,YAAY,CAAC,aAAa;QAAE,OAAO,OAAO,YAAY,CAAC,aAAa,EAAE,CAAC;IAC3E,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,IAA2D,EAC3D,MAMC;IAED,MAAM,UAAU,GAAG,iBAAiB,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;IACnF,MAAM,qBAAqB,GAAG,mCAAmC,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;IAC9G,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;QAC3F,IAAI,KAAK,GAAG,qBAAqB,EAAE,CAAC;YAClC,mFAAmF;YACnF,IAAI,iBAAiB,GAAG,MAAM,CAAC,aAAa,CAAC;YAC7C,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;gBAChE,IAAI,GAAG,GAAG,CAAC;oBAAE,iBAAiB,GAAG,GAAG,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,uFAAuF;YACzF,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,iBAAiB,EAAE,CAAC;QACrD,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,iFAAiF;QACjF,iFAAiF;QACjF,kDAAkD;QAClD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iGAAiG,EAAE;YAClH,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,GAAG,2BAA2B,CAAC,KAAK,CAAC;SACtC,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC;AACH,CAAC","sourcesContent":["import type { ExecutionContext_InitiatorIds, ResourceServerKind, RuntimeEnvironment } from '@wildo-ai/saas-models';\nimport type { RedisService } from '~wildo-backend-lib/databases/services/redis.service';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport type { SocketAuthResult } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport { projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { relaxAbuseThrottleMaxForEnvironment } from '~wildo-backend-lib/errors/utils/rate-limit-environment-relaxation.backend.utils';\n\n/**\n * Per-PRINCIPAL success-path throttle for the external agent transports (A2A / MCP).\n *\n * ## Why this exists, and how it differs from the auth guard next door\n *\n * `machine-auth-rate-limit.backend.utils.ts` is a **failure-keyed** brute-force guard —\n * it only counts REJECTED secret/token presentations, keyed on the source IP, and it\n * deliberately does NOT throttle a valid token (a signature-gated token cannot be\n * guessed). That leaves a real exposure this util closes: an authenticated caller\n * holding ONE valid credential can drive UNBOUNDED work on the credentialed endpoints —\n * for A2A, unbounded LLM turns (direct spend + noisy-neighbor exhaustion of the app's\n * shared upstream model quota); for MCP, unbounded resource-operation dispatch (DB load).\n * There is no app-level global HTTP limiter on these routes, so the only cap is the one\n * added here.\n *\n * This guard is therefore the mirror image of the auth guard:\n * - **Success-keyed, per PRINCIPAL** — every ACCEPTED turn/call increments a counter keyed\n *   on the authenticated principal (`userId` \\| `organizationId` \\| `applicationId`), never\n *   on a caller/LLM-supplied value. Keying on the principal (not the IP) caps the actual\n *   spend axis: the credential. (The FAILURE path already feeds a per-IP counter.)\n * - **Fixed window, increment-then-compare** — the Nth call's atomic `INCR` returns N; once\n *   N exceeds the cap the caller is throttled for the remainder of the window. A throttled\n *   attempt still consumed its `INCR`, which is intentional: a burst of rejected attempts\n *   keeps the abuser saturated rather than clearing the window.\n * - **Fails OPEN on a limiter outage** — a Redis failure must never break the external\n *   endpoint. This is an ABUSE-throttle, not a billing boundary; consistency with the\n *   sibling auth limiter. (The future per-tenant SPEND budget is a billing boundary and\n *   will fail CLOSED instead — do not copy this fail-open policy there.)\n *\n * ## Distinct caps per surface (semantic precision)\n *\n * A2A `message/send` runs an LLM agent turn; MCP `tools/call` dispatches a CRUD resource\n * operation — NOT an LLM call. Their abuse profiles differ (model spend vs DB load), so the\n * two surfaces carry distinct caps rather than one merged number. All caps are framework\n * defaults, tunable later (a per-tenant budget / app-config surface is the follow-on).\n */\n\n/** Max A2A agent turns (`message/send` + `message/stream`) per principal per window (LLM spend — tighter). */\nexport const A2A_EXTERNAL_TURN_RATE_MAX = 30;\n/** Rolling window (seconds) for the A2A per-principal turn cap. */\nexport const A2A_EXTERNAL_TURN_RATE_WINDOW_SECONDS = 60;\n\n/** Max MCP `tools/call` dispatches per principal per window (resource-op load — looser). */\nexport const MCP_EXTERNAL_CALL_RATE_MAX = 120;\n/** Rolling window (seconds) for the MCP per-principal call cap. */\nexport const MCP_EXTERNAL_CALL_RATE_WINDOW_SECONDS = 60;\n\n/**\n * Outcome of a per-principal throttle check. STRING discriminant (`kind`) because this\n * package compiles with `strictNullChecks` off, under which boolean-literal discriminated\n * unions do not narrow reliably (same rationale as the A2A/MCP transport result types).\n * Returned rather than thrown so the caller can emit a controlled transport response\n * (HTTP 429 + `Retry-After`) instead of routing a `RATE_LIMIT` error through the generic\n * async error handler.\n */\nexport type ExternalTurnRateDecision =\n  | { kind: 'ok' }\n  | { kind: 'rate_limited'; retryAfterSeconds: number };\n\n/**\n * Derive the stable throttle key for an authenticated principal from its server-verified\n * identity. A user-delegated principal carries a `userId`; a machine principal carries\n * exactly one of `organizationId` / `applicationId`. Returns `undefined` for an unkeyable\n * principal (defensive — auth already fails closed for a principal with no resolvable\n * owner id, so the caller treats `undefined` as \"cannot throttle → proceed\", fail-open).\n */\nexport function resolvePrincipalRateKey(auth: SocketAuthResult): string | undefined {\n  const ids = auth.initiatorIds;\n  if (!ids) return undefined;\n  if (ids.userId) return `user:${ids.userId}`;\n  if (ids.organizationId) return `org:${ids.organizationId}`;\n  if (ids.applicationId) return `app:${ids.applicationId}`;\n  return undefined;\n}\n\n/**\n * Derive the counting subject for an operation's OWN declared `rateLimit` policy on a\n * credentialed agent plane (today: MCP `tools/call`). Sits beside\n * {@link resolvePrincipalRateKey} on purpose — the two answer the same question for two\n * different guards, and the ONE thing a reader must not have to reconstruct is why they\n * answer it differently.\n *\n * ## The precedence differs from {@link resolvePrincipalRateKey}, and that is the decision\n *\n * `resolvePrincipalRateKey` deliberately keys the framework's blanket abuse throttle on the\n * principal's OWNER (`user` → `org` → `app`). That is right for a spend guard: the thing being\n * protected is the tenant's shared upstream quota, so every credential the tenant issued should\n * saturate ONE bucket and a tenant cannot buy more headroom by minting more clients.\n *\n * An AUTHORED per-endpoint `rateLimit` is a different statement. Over HTTP it is enforced\n * per SOURCE IP — one caller, one budget — so `requestsPerMinute: 5` has never meant \"5/min\n * for the whole tenant\"; it means \"5/min per client, and N clients get N × 5\". The faithful\n * translation onto a plane whose callers are credentials rather than sockets is therefore the\n * CREDENTIAL: two agents an organization runs against the same tool are two clients, exactly as\n * two browsers on two IPs are. Keying this guard on the org instead would silently make the\n * SAME declared number roughly N times stricter over MCP than over REST for any tenant running\n * more than one agent — the \"throttles a whole tenant on one agent's traffic\" failure — and an\n * application author reading `requestsPerMinute: 5` has no way to discover that.\n *\n * Hence: credential first, then the delegated user, then the owning scope as a last resort.\n * The scope fallback is defensive only — an authenticated MCP caller is either a machine (which\n * always carries `machineCredential`) or user-delegated (which always carries `userId`).\n *\n * Every branch reads a SERVER-VERIFIED field of the execution context. Nothing here may ever be\n * sourced from tool arguments or any other model-supplied value, or the throttle becomes\n * opt-out by an attacker choosing a fresh bucket per call.\n *\n * @returns `undefined` when no identity field is present (see the call site for what that means\n *   there — this function does not decide the posture, it only reports that it cannot key).\n */\nexport function resolveDeclaredPolicySubjectKey(initiatorIds: ExecutionContext_InitiatorIds | null | undefined): string | undefined {\n  if (!initiatorIds) return undefined;\n  const credential = initiatorIds.machineCredential;\n  // The auth method rides the key because the two credential kinds are separate id spaces\n  // (an ApiKey row id and an OAuthClient row id could collide) — never as a policy axis.\n  if (credential?.credentialId) return `cred:${credential.authMethod}:${credential.credentialId}`;\n  if (initiatorIds.userId) return `user:${initiatorIds.userId}`;\n  if (initiatorIds.organizationId) return `org:${initiatorIds.organizationId}`;\n  if (initiatorIds.applicationId) return `app:${initiatorIds.applicationId}`;\n  return undefined;\n}\n\n/**\n * Increment and evaluate the per-principal counter for one external turn/call. Call this\n * AFTER authentication and BEFORE the expensive dispatch (LLM turn / resource op). Returns\n * `{ kind: 'rate_limited', retryAfterSeconds }` once the principal exceeds `maxPerWindow`\n * in the window, otherwise `{ kind: 'ok' }`. Fails OPEN (returns `ok`) on any Redis error.\n *\n * `params.applicationEnv` scales `maxPerWindow` in DEVELOPMENT/TEST through the shared\n * relaxation seam, so an e2e suite driving many A2A turns or MCP calls under one\n * provisioned principal is not throttled by a production-authored spend guard.\n * `STAGING`/`PRODUCTION` enforce the caller's number exactly.\n */\nexport async function assertExternalTurnWithinRate(\n  deps: { redisService: RedisService; logger: LoggerService },\n  params: {\n    principalKey: string;\n    resourceServer: ResourceServerKind;\n    maxPerWindow: number;\n    windowSeconds: number;\n    applicationEnv: RuntimeEnvironment;\n  },\n): Promise<ExternalTurnRateDecision> {\n  const identifier = `external_turn:${params.resourceServer}:${params.principalKey}`;\n  const effectiveMaxPerWindow = relaxAbuseThrottleMaxForEnvironment(params.maxPerWindow, params.applicationEnv);\n  try {\n    const count = await deps.redisService.incrementRateLimit(identifier, params.windowSeconds);\n    if (count > effectiveMaxPerWindow) {\n      // Prefer the live TTL for an accurate `Retry-After`; fall back to the full window.\n      let retryAfterSeconds = params.windowSeconds;\n      try {\n        const ttl = await deps.redisService.getRateLimitTtl(identifier);\n        if (ttl > 0) retryAfterSeconds = ttl;\n      } catch {\n        // Keep the window fallback — a TTL read failure must not upgrade this to a hard error.\n      }\n      return { kind: 'rate_limited', retryAfterSeconds };\n    }\n    return { kind: 'ok' };\n  } catch (error) {\n    // Fail OPEN: a limiter outage must never break the external endpoint. This is an\n    // abuse-throttle, not a billing boundary — the per-tenant spend budget (a later,\n    // separate concern) is the one that fails closed.\n    deps.logger.warn('[external-turn-rate-limit] throttle check skipped (rate-limit store unavailable) — failing open', {\n      resourceServer: params.resourceServer,\n      ...projectCaughtErrorLogFields(error),\n    });\n    return { kind: 'ok' };\n  }\n}\n"]}

package/dist/esm/security/authentications/services/utils/machine-auth-rate-limit.backend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"machine-auth-rate-limit.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/utils/machine-auth-rate-limit.backend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0C,KAAK,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AACxG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACxF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAGnH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AAE9H;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAE3C,+FAA+F;AAC/F,eAAO,MAAM,mCAAmC,MAAM,CAAC;AAKvD;;;;;;;;;;GAUG;AACH,wBAAsB,kCAAkC,CACtD,YAAY,EAAE,YAAY,EAC1B,YAAY,EAAE,0BAA0B,EACxC,MAAM,EAAE,aAAa,EACrB,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,kBAAkB,GACjC,OAAO,CAAC,IAAI,CAAC,CAsBf;AAED;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAC5C,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,aAAa,EACrB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAQf;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,8BAA8B,CAClD,IAAI,EAAE;IAAE,YAAY,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,aAAa,CAAC;IAAC,SAAS,EAAE,IAAI,CAAC,uBAAuB,EAAE,sBAAsB,CAAC,CAAA;CAAE,EAC7H,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACnE,OAAO,CAAC,IAAI,CAAC,CAUf"}
+{"version":3,"file":"machine-auth-rate-limit.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/utils/machine-auth-rate-limit.backend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0C,KAAK,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AACxG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACxF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAGnH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AAE9H;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAE3C,+FAA+F;AAC/F,eAAO,MAAM,mCAAmC,MAAM,CAAC;AAKvD;;;;;;;;;;GAUG;AACH,wBAAsB,kCAAkC,CACtD,YAAY,EAAE,YAAY,EAC1B,YAAY,EAAE,0BAA0B,EACxC,MAAM,EAAE,aAAa,EACrB,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,kBAAkB,GACjC,OAAO,CAAC,IAAI,CAAC,CAsBf;AAED;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAC5C,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,aAAa,EACrB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAQf;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,8BAA8B,CAClD,IAAI,EAAE;IAAE,YAAY,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,aAAa,CAAC;IAAC,SAAS,EAAE,IAAI,CAAC,uBAAuB,EAAE,sBAAsB,CAAC,CAAA;CAAE,EAC7H,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACnE,OAAO,CAAC,IAAI,CAAC,CAUf"}

package/dist/esm/security/authentications/services/utils/pkce.backend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pkce.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/utils/pkce.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AASH,8GAA8G;AAC9G,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAExE;AAED,uGAAuG;AACvG,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAEvE"}
+{"version":3,"file":"pkce.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/utils/pkce.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AASH,8GAA8G;AAC9G,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAExE;AAED,uGAAuG;AACvG,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAEvE"}

package/dist/esm/security/authentications/services/utils/saml-java-availability.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"saml-java-availability.d.ts","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/utils/saml-java-availability.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAyBH;;;;;GAKG;AACH,oBAAY,iCAAiC;IAC3C,4DAA4D;IAC5D,oBAAoB,yBAAyB;IAC7C,iFAAiF;IACjF,4BAA4B,iCAAiC;IAC7D,sFAAsF;IACtF,4BAA4B,iCAAiC;CAC9D;AAED,iEAAiE;AACjE,MAAM,WAAW,6BAA6B;IAC5C,yEAAyE;IACzE,SAAS,EAAE,OAAO,CAAC;IACnB,+EAA+E;IAC/E,KAAK,CAAC,EAAE,iCAAiC,CAAC;IAC1C,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAID;;;;;;;;GAQG;AACH,wBAAgB,oCAAoC,IAAI,MAAM,GAAG,IAAI,CAQpE;AAsDD;;;GAGG;AACH,wBAAgB,kCAAkC,IAAI,6BAA6B,CAMlF;AAED;;;;GAIG;AACH,wBAAgB,oCAAoC,CAAC,MAAM,EAAE,6BAA6B,GAAG,MAAM,CAWlG;AAED,0EAA0E;AAC1E,wBAAgB,uCAAuC,IAAI,IAAI,CAE9D;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAO3C"}
+{"version":3,"file":"saml-java-availability.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/utils/saml-java-availability.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAyBH;;;;;GAKG;AACH,oBAAY,iCAAiC;IAC3C,4DAA4D;IAC5D,oBAAoB,yBAAyB;IAC7C,iFAAiF;IACjF,4BAA4B,iCAAiC;IAC7D,sFAAsF;IACtF,4BAA4B,iCAAiC;CAC9D;AAED,iEAAiE;AACjE,MAAM,WAAW,6BAA6B;IAC5C,yEAAyE;IACzE,SAAS,EAAE,OAAO,CAAC;IACnB,+EAA+E;IAC/E,KAAK,CAAC,EAAE,iCAAiC,CAAC;IAC1C,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAID;;;;;;;;GAQG;AACH,wBAAgB,oCAAoC,IAAI,MAAM,GAAG,IAAI,CAQpE;AAsDD;;;GAGG;AACH,wBAAgB,kCAAkC,IAAI,6BAA6B,CAMlF;AAED;;;;GAIG;AACH,wBAAgB,oCAAoC,CAAC,MAAM,EAAE,6BAA6B,GAAG,MAAM,CAWlG;AAED,0EAA0E;AAC1E,wBAAgB,uCAAuC,IAAI,IAAI,CAE9D;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAO3C"}

package/dist/esm/security/authentications/utils/application-auth-policy-audit.backend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"application-auth-policy-audit.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/utils/application-auth-policy-audit.backend.utils.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,6BAA6B,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE5F;;;;;;;;;GASG;AAEH;;;;GAIG;AACH,MAAM,MAAM,gCAAgC,GAAG,MAAM,CAAC,MAAM,EAAE,6BAA6B,CAAC,CAAC;AAE7F;;;;;;;;;;GAUG;AACH,wBAAgB,kCAAkC,CAAC,SAAS,EAAE,eAAe,GAAG,gCAAgC,CAS/G;AAuBD;;;;;;GAMG;AACH,wBAAgB,0CAA0C,CAAC,QAAQ,EAAE,gCAAgC,GAAG,MAAM,CAE7G;AAED;;;;;GAKG;AACH,wBAAgB,yCAAyC,CACvD,MAAM,EAAE,gCAAgC,GAAG,IAAI,EAC/C,KAAK,EAAE,gCAAgC,GACtC,MAAM,EAAE,CAgBV"}
+{"version":3,"file":"application-auth-policy-audit.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/utils/application-auth-policy-audit.backend.utils.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,6BAA6B,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE5F;;;;;;;;;GASG;AAEH;;;;GAIG;AACH,MAAM,MAAM,gCAAgC,GAAG,MAAM,CAAC,MAAM,EAAE,6BAA6B,CAAC,CAAC;AAE7F;;;;;;;;;;GAUG;AACH,wBAAgB,kCAAkC,CAAC,SAAS,EAAE,eAAe,GAAG,gCAAgC,CAS/G;AAuBD;;;;;;GAMG;AACH,wBAAgB,0CAA0C,CAAC,QAAQ,EAAE,gCAAgC,GAAG,MAAM,CAE7G;AAED;;;;;GAKG;AACH,wBAAgB,yCAAyC,CACvD,MAAM,EAAE,gCAAgC,GAAG,IAAI,EAC/C,KAAK,EAAE,gCAAgC,GACtC,MAAM,EAAE,CAgBV"}

package/dist/esm/security/authentications/utils/enterprise-sso-enforcement.backend.utils.d.ts

@@ -3,9 +3,50 @@ interface EnterpriseSsoEnforcementLike {
     requireSSO?: boolean | undefined;
     allowPasswordFallback?: boolean | undefined;
 }
+/** The break-glass half of a tenant's SSO policy, taken structurally so a partial config fits. */
+export interface EmergencyAccessLike {
+    enabled?: boolean | undefined;
+    breakGlassAccounts?: readonly string[] | undefined;
+}
 interface DomainOrgLookupLike {
     enforcement?: EnterpriseSsoEnforcementLike | undefined;
+    ssoConfig?: {
+        emergencyAccess?: EmergencyAccessLike | undefined;
+    } | undefined;
 }
+/**
+ * Does this tenant have break-glass accounts that could actually be used?
+ *
+ * `enabled` alone grants nothing: the LIST is what confers the bypass, so an empty list with the
+ * switch on is the same as no break-glass at all. Written as one predicate because both the offered
+ * methods and the enforcement gate must agree about it — if they disagree, either the accounts
+ * cannot reach a password field or everyone else can.
+ */
+export declare function tenantHasUsableBreakGlassAccounts(domainOrgLookup?: DomainOrgLookupLike | null | undefined): boolean;
+/**
+ * Is this address one of the tenant's named break-glass accounts?
+ *
+ * Compared case-insensitively on the address, because that is how the operator authored it and how
+ * the caller typed it. The CALLER's claim is never the input — every call site passes the address of
+ * a user whose credential has already been verified.
+ */
+export declare function isBreakGlassAccount(emergencyAccess: EmergencyAccessLike | undefined | null, email: string | undefined | null): boolean;
+/**
+ * Must this tenant's sign-in page offer ONLY enterprise methods?
+ *
+ * ## Why break-glass answers this for the whole tenant rather than per account
+ *
+ * A tenant with named break-glass accounts keeps its password field — for EVERY address at the
+ * domain, not for the listed ones. This is the enumeration-safety decision (#481/#423): the offered
+ * method list is built before anything is authenticated, from an email hint, so narrowing it for
+ * the listed accounts would make the sign-in page an oracle for who they are. A break-glass list is
+ * a small, high-value target; publishing its membership to anyone who can type an address is worse
+ * than the outage it protects against.
+ *
+ * What refuses everyone else is the enforcement gate, AFTER the password is verified. So the cost
+ * of this is a password field that only the listed accounts can use, and the benefit is that
+ * nothing about the response says which those are.
+ */
 export declare function requiresEnterpriseSsoOnly(domainOrgLookup?: DomainOrgLookupLike | null | undefined): boolean;
 export declare function restrictFirstFactorMethodsForEnterpriseSso(methods: ReadonlyArray<AvailableMethod>, domainOrgLookup?: DomainOrgLookupLike | null | undefined): AvailableMethod[];
 export {};

package/dist/esm/security/authentications/utils/enterprise-sso-enforcement.backend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"enterprise-sso-enforcement.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/utils/enterprise-sso-enforcement.backend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAEzE,UAAU,4BAA4B;IACpC,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACjC,qBAAqB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC7C;AAED,UAAU,mBAAmB;IAC3B,WAAW,CAAC,EAAE,4BAA4B,GAAG,SAAS,CAAC;CACxD;AAED,wBAAgB,yBAAyB,CACvC,eAAe,CAAC,EAAE,mBAAmB,GAAG,IAAI,GAAG,SAAS,GACvD,OAAO,CAGT;AAED,wBAAgB,0CAA0C,CACxD,OAAO,EAAE,aAAa,CAAC,eAAe,CAAC,EACvC,eAAe,CAAC,EAAE,mBAAmB,GAAG,IAAI,GAAG,SAAS,GACvD,eAAe,EAAE,CAUnB"}
+{"version":3,"file":"enterprise-sso-enforcement.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/utils/enterprise-sso-enforcement.backend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAEzE,UAAU,4BAA4B;IACpC,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACjC,qBAAqB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC7C;AAED,kGAAkG;AAClG,MAAM,WAAW,mBAAmB;IAClC,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CACpD;AAED,UAAU,mBAAmB;IAC3B,WAAW,CAAC,EAAE,4BAA4B,GAAG,SAAS,CAAC;IACvD,SAAS,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAA;KAAE,GAAG,SAAS,CAAC;CAC/E;AAED;;;;;;;GAOG;AACH,wBAAgB,iCAAiC,CAC/C,eAAe,CAAC,EAAE,mBAAmB,GAAG,IAAI,GAAG,SAAS,GACvD,OAAO,CAIT;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,eAAe,EAAE,mBAAmB,GAAG,SAAS,GAAG,IAAI,EACvD,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAC/B,OAAO,CAMT;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,yBAAyB,CACvC,eAAe,CAAC,EAAE,mBAAmB,GAAG,IAAI,GAAG,SAAS,GACvD,OAAO,CAMT;AAED,wBAAgB,0CAA0C,CACxD,OAAO,EAAE,aAAa,CAAC,eAAe,CAAC,EACvC,eAAe,CAAC,EAAE,mBAAmB,GAAG,IAAI,GAAG,SAAS,GACvD,eAAe,EAAE,CAUnB"}

package/dist/esm/security/authentications/utils/enterprise-sso-enforcement.backend.utils.js

@@ -1,5 +1,50 @@
 import { AuthMethod } from '@wildo-ai/saas-models';
+/**
+ * Does this tenant have break-glass accounts that could actually be used?
+ *
+ * `enabled` alone grants nothing: the LIST is what confers the bypass, so an empty list with the
+ * switch on is the same as no break-glass at all. Written as one predicate because both the offered
+ * methods and the enforcement gate must agree about it — if they disagree, either the accounts
+ * cannot reach a password field or everyone else can.
+ */
+export function tenantHasUsableBreakGlassAccounts(domainOrgLookup) {
+    const emergencyAccess = domainOrgLookup?.ssoConfig?.emergencyAccess;
+    return emergencyAccess?.enabled === true
+        && (emergencyAccess.breakGlassAccounts?.length ?? 0) > 0;
+}
+/**
+ * Is this address one of the tenant's named break-glass accounts?
+ *
+ * Compared case-insensitively on the address, because that is how the operator authored it and how
+ * the caller typed it. The CALLER's claim is never the input — every call site passes the address of
+ * a user whose credential has already been verified.
+ */
+export function isBreakGlassAccount(emergencyAccess, email) {
+    if (emergencyAccess?.enabled !== true || !email)
+        return false;
+    const normalized = email.trim().toLowerCase();
+    return (emergencyAccess.breakGlassAccounts ?? []).some((account) => account.trim().toLowerCase() === normalized);
+}
+/**
+ * Must this tenant's sign-in page offer ONLY enterprise methods?
+ *
+ * ## Why break-glass answers this for the whole tenant rather than per account
+ *
+ * A tenant with named break-glass accounts keeps its password field — for EVERY address at the
+ * domain, not for the listed ones. This is the enumeration-safety decision (#481/#423): the offered
+ * method list is built before anything is authenticated, from an email hint, so narrowing it for
+ * the listed accounts would make the sign-in page an oracle for who they are. A break-glass list is
+ * a small, high-value target; publishing its membership to anyone who can type an address is worse
+ * than the outage it protects against.
+ *
+ * What refuses everyone else is the enforcement gate, AFTER the password is verified. So the cost
+ * of this is a password field that only the listed accounts can use, and the benefit is that
+ * nothing about the response says which those are.
+ */
 export function requiresEnterpriseSsoOnly(domainOrgLookup) {
+    if (tenantHasUsableBreakGlassAccounts(domainOrgLookup)) {
+        return false;
+    }
     return domainOrgLookup?.enforcement?.requireSSO === true
         && domainOrgLookup.enforcement.allowPasswordFallback !== true;
 }

package/dist/esm/security/authentications/utils/enterprise-sso-enforcement.backend.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"enterprise-sso-enforcement.backend.utils.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/utils/enterprise-sso-enforcement.backend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAwB,MAAM,uBAAuB,CAAC;AAWzE,MAAM,UAAU,yBAAyB,CACvC,eAAwD;IAExD,OAAO,eAAe,EAAE,WAAW,EAAE,UAAU,KAAK,IAAI;WACnD,eAAe,CAAC,WAAW,CAAC,qBAAqB,KAAK,IAAI,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,0CAA0C,CACxD,OAAuC,EACvC,eAAwD;IAExD,IAAI,CAAC,yBAAyB,CAAC,eAAe,CAAC,EAAE,CAAC;QAChD,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;IACtB,CAAC;IAED,OAAO,OAAO,CAAC,MAAM,CACnB,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC,kBAAkB;WAC5C,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC,QAAQ,CAC3C,CAAC;AACJ,CAAC","sourcesContent":["import { AuthMethod, type AvailableMethod } from '@wildo-ai/saas-models';\n\ninterface EnterpriseSsoEnforcementLike {\n  requireSSO?: boolean | undefined;\n  allowPasswordFallback?: boolean | undefined;\n}\n\ninterface DomainOrgLookupLike {\n  enforcement?: EnterpriseSsoEnforcementLike | undefined;\n}\n\nexport function requiresEnterpriseSsoOnly(\n  domainOrgLookup?: DomainOrgLookupLike | null | undefined,\n): boolean {\n  return domainOrgLookup?.enforcement?.requireSSO === true\n    && domainOrgLookup.enforcement.allowPasswordFallback !== true;\n}\n\nexport function restrictFirstFactorMethodsForEnterpriseSso(\n  methods: ReadonlyArray<AvailableMethod>,\n  domainOrgLookup?: DomainOrgLookupLike | null | undefined,\n): AvailableMethod[] {\n  if (!requiresEnterpriseSsoOnly(domainOrgLookup)) {\n    return [...methods];\n  }\n\n  return methods.filter(\n    (method) =>\n      method.method === AuthMethod.ORG_OPENID_CONNECT\n      || method.method === AuthMethod.ORG_SAML,\n  );\n}\n"]}
+{"version":3,"file":"enterprise-sso-enforcement.backend.utils.js","sourceRoot":"","sources":["../../../../../src/security/authentications/utils/enterprise-sso-enforcement.backend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAwB,MAAM,uBAAuB,CAAC;AAkBzE;;;;;;;GAOG;AACH,MAAM,UAAU,iCAAiC,CAC/C,eAAwD;IAExD,MAAM,eAAe,GAAG,eAAe,EAAE,SAAS,EAAE,eAAe,CAAC;IACpE,OAAO,eAAe,EAAE,OAAO,KAAK,IAAI;WACnC,CAAC,eAAe,CAAC,kBAAkB,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,eAAuD,EACvD,KAAgC;IAEhC,IAAI,eAAe,EAAE,OAAO,KAAK,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,OAAO,CAAC,eAAe,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,IAAI,CACpD,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,UAAU,CACzD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,yBAAyB,CACvC,eAAwD;IAExD,IAAI,iCAAiC,CAAC,eAAe,CAAC,EAAE,CAAC;QACvD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,eAAe,EAAE,WAAW,EAAE,UAAU,KAAK,IAAI;WACnD,eAAe,CAAC,WAAW,CAAC,qBAAqB,KAAK,IAAI,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,0CAA0C,CACxD,OAAuC,EACvC,eAAwD;IAExD,IAAI,CAAC,yBAAyB,CAAC,eAAe,CAAC,EAAE,CAAC;QAChD,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;IACtB,CAAC;IAED,OAAO,OAAO,CAAC,MAAM,CACnB,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC,kBAAkB;WAC5C,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC,QAAQ,CAC3C,CAAC;AACJ,CAAC","sourcesContent":["import { AuthMethod, type AvailableMethod } from '@wildo-ai/saas-models';\n\ninterface EnterpriseSsoEnforcementLike {\n  requireSSO?: boolean | undefined;\n  allowPasswordFallback?: boolean | undefined;\n}\n\n/** The break-glass half of a tenant's SSO policy, taken structurally so a partial config fits. */\nexport interface EmergencyAccessLike {\n  enabled?: boolean | undefined;\n  breakGlassAccounts?: readonly string[] | undefined;\n}\n\ninterface DomainOrgLookupLike {\n  enforcement?: EnterpriseSsoEnforcementLike | undefined;\n  ssoConfig?: { emergencyAccess?: EmergencyAccessLike | undefined } | undefined;\n}\n\n/**\n * Does this tenant have break-glass accounts that could actually be used?\n *\n * `enabled` alone grants nothing: the LIST is what confers the bypass, so an empty list with the\n * switch on is the same as no break-glass at all. Written as one predicate because both the offered\n * methods and the enforcement gate must agree about it — if they disagree, either the accounts\n * cannot reach a password field or everyone else can.\n */\nexport function tenantHasUsableBreakGlassAccounts(\n  domainOrgLookup?: DomainOrgLookupLike | null | undefined,\n): boolean {\n  const emergencyAccess = domainOrgLookup?.ssoConfig?.emergencyAccess;\n  return emergencyAccess?.enabled === true\n    && (emergencyAccess.breakGlassAccounts?.length ?? 0) > 0;\n}\n\n/**\n * Is this address one of the tenant's named break-glass accounts?\n *\n * Compared case-insensitively on the address, because that is how the operator authored it and how\n * the caller typed it. The CALLER's claim is never the input — every call site passes the address of\n * a user whose credential has already been verified.\n */\nexport function isBreakGlassAccount(\n  emergencyAccess: EmergencyAccessLike | undefined | null,\n  email: string | undefined | null,\n): boolean {\n  if (emergencyAccess?.enabled !== true || !email) return false;\n  const normalized = email.trim().toLowerCase();\n  return (emergencyAccess.breakGlassAccounts ?? []).some(\n    (account) => account.trim().toLowerCase() === normalized,\n  );\n}\n\n/**\n * Must this tenant's sign-in page offer ONLY enterprise methods?\n *\n * ## Why break-glass answers this for the whole tenant rather than per account\n *\n * A tenant with named break-glass accounts keeps its password field — for EVERY address at the\n * domain, not for the listed ones. This is the enumeration-safety decision (#481/#423): the offered\n * method list is built before anything is authenticated, from an email hint, so narrowing it for\n * the listed accounts would make the sign-in page an oracle for who they are. A break-glass list is\n * a small, high-value target; publishing its membership to anyone who can type an address is worse\n * than the outage it protects against.\n *\n * What refuses everyone else is the enforcement gate, AFTER the password is verified. So the cost\n * of this is a password field that only the listed accounts can use, and the benefit is that\n * nothing about the response says which those are.\n */\nexport function requiresEnterpriseSsoOnly(\n  domainOrgLookup?: DomainOrgLookupLike | null | undefined,\n): boolean {\n  if (tenantHasUsableBreakGlassAccounts(domainOrgLookup)) {\n    return false;\n  }\n  return domainOrgLookup?.enforcement?.requireSSO === true\n    && domainOrgLookup.enforcement.allowPasswordFallback !== true;\n}\n\nexport function restrictFirstFactorMethodsForEnterpriseSso(\n  methods: ReadonlyArray<AvailableMethod>,\n  domainOrgLookup?: DomainOrgLookupLike | null | undefined,\n): AvailableMethod[] {\n  if (!requiresEnterpriseSsoOnly(domainOrgLookup)) {\n    return [...methods];\n  }\n\n  return methods.filter(\n    (method) =>\n      method.method === AuthMethod.ORG_OPENID_CONNECT\n      || method.method === AuthMethod.ORG_SAML,\n  );\n}\n"]}

package/dist/esm/security/authentications/utils/one-off-session-lifetime.backend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"one-off-session-lifetime.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/utils/one-off-session-lifetime.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE;IAAE,SAAS,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,IAAI,CAAA;CAAE,EAC3C,GAAG,EAAE,IAAI,EACT,cAAc,EAAE,MAAM,GACrB,IAAI,CAKN"}
+{"version":3,"file":"one-off-session-lifetime.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/utils/one-off-session-lifetime.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE;IAAE,SAAS,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,IAAI,CAAA;CAAE,EAC3C,GAAG,EAAE,IAAI,EACT,cAAc,EAAE,MAAM,GACrB,IAAI,CAKN"}

package/dist/esm/security/authentications/utils/social-oauth2-purpose.backend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"social-oauth2-purpose.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/utils/social-oauth2-purpose.backend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAC;AAEtE,UAAU,8BAA8B;IACtC,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,OAAO,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;CACtC;AAED,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,cAAc,GAAG,SAAS,GAClC,OAAO,CAIT;AAED,wBAAgB,kCAAkC,CAChD,cAAc,EAAE,8BAA8B,GAAG,IAAI,GAAG,SAAS,GAChE,OAAO,CAGT"}
+{"version":3,"file":"social-oauth2-purpose.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/utils/social-oauth2-purpose.backend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAC;AAEtE,UAAU,8BAA8B;IACtC,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,OAAO,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;CACtC;AAED,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,cAAc,GAAG,SAAS,GAClC,OAAO,CAIT;AAED,wBAAgB,kCAAkC,CAChD,cAAc,EAAE,8BAA8B,GAAG,IAAI,GAAG,SAAS,GAChE,OAAO,CAGT"}

package/dist/esm/security/authorizations/access-grant-decision.factory.backend.d.ts

@@ -0,0 +1,59 @@
+/**
+ * The decision verbs of an access grant — `approve` / `deny` / `revoke` / `expire` — for BOTH grant
+ * resources.
+ *
+ * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — a grant's status may only move through a verb
+ * that checks the transition and records it.
+ *
+ * ## What is shared and what is not
+ *
+ * Shared: refuse unless the current status permits the transition, write exactly the fields that
+ * transition owns, and record it after commit. That is identical for a tenant elevation and an
+ * application-wide one, because it is a property of the LIFECYCLE, and the two lifecycles are the
+ * same lifecycle.
+ *
+ * NOT shared, and passed in: `additionalPrecondition`. The application-wide `approve` refuses a
+ * SELF-approval — the two-person rule — and nothing equivalent exists on the tenant resource, where
+ * the requester is a platform operator and the approver is a tenant administrator, so they cannot be
+ * the same person by construction.
+ *
+ * ## Why the guard is here at all when `enabledCondition` already exists
+ *
+ * `enabledCondition` on the operation config is evaluated against the row the framework fetched and
+ * is a UI-and-dispatch concern. This is the fail-closed half: a custom implementation is addressed by
+ * an exact operation path and inherits nothing, so a future variant authored without an
+ * `enabledCondition` would otherwise transition a terminal grant — or approve a self-request —
+ * silently. Neither guard alone is the control; both are, and each has its own pin.
+ */
+import { CoreResourceType, PlatformAccessGrantLifecycleTransition, PlatformAccessGrantScope, PlatformAccessGrantStatus, ResourceOperationVariantType } from '@wildo-ai/saas-models';
+import type { ResourceCustomServiceImplementationFactory } from '../../base-classes/services/services/resource-operation-custom-implementation.factory.backend';
+/**
+ * A refusal a specific verb owns, evaluated after the status precondition and before the write.
+ *
+ * Returns the `reason` token to refuse with, or `undefined` to permit. A token rather than a boolean
+ * because the refusal reaches a client as a `CONFLICT` context and a reviewer as a log line, and
+ * `false` cannot say which rule fired.
+ */
+export type AccessGrantDecisionPrecondition = (params: {
+    readonly currentObject: Record<string, unknown> | undefined;
+    readonly deciderUserId: string | undefined;
+}) => string | undefined;
+export declare function createAccessGrantDecisionFactory(resourceIdentifier: CoreResourceType, grantScope: PlatformAccessGrantScope, operationIdentifier: string, options: {
+    debugLabel: string;
+    nextStatus: PlatformAccessGrantStatus;
+    permittedFrom: readonly PlatformAccessGrantStatus[];
+    stampsApprover: boolean;
+    auditTransition: PlatformAccessGrantLifecycleTransition;
+    /** The token a status-precondition failure refuses with — each resource names its own. */
+    transitionRefusalReason: string;
+    /** The verb-specific refusal, when the verb has one. See {@link AccessGrantDecisionPrecondition}. */
+    additionalPrecondition?: AccessGrantDecisionPrecondition;
+    /**
+     * Defaults to API_CALL — every operator-facing decision. EXPIRE is INTERNAL_CALL, and the lookup
+     * key is built from the RUNNING operation's variant type, so a mismatch here does not fail
+     * loudly: the implementation is simply never found and the core UPDATE runs with no transition
+     * guard and no audit row.
+     */
+    variantType?: ResourceOperationVariantType;
+}): ResourceCustomServiceImplementationFactory;
+//# sourceMappingURL=access-grant-decision.factory.backend.d.ts.map

package/dist/esm/security/authorizations/access-grant-decision.factory.backend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-grant-decision.factory.backend.d.ts","sourceRoot":"","sources":["../../../../src/security/authorizations/access-grant-decision.factory.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,EACL,gBAAgB,EAGhB,sCAAsC,EACtC,wBAAwB,EACxB,yBAAyB,EACzB,4BAA4B,EAC7B,MAAM,uBAAuB,CAAC;AAI/B,OAAO,KAAK,EAAE,0CAA0C,EAAE,MAAM,4GAA4G,CAAC;AAG7K;;;;;;GAMG;AACH,MAAM,MAAM,+BAA+B,GAAG,CAAC,MAAM,EAAE;IACrD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;IAC5D,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5C,KAAK,MAAM,GAAG,SAAS,CAAC;AAEzB,wBAAgB,gCAAgC,CAC9C,kBAAkB,EAAE,gBAAgB,EACpC,UAAU,EAAE,wBAAwB,EAGpC,mBAAmB,EAAE,MAAM,EAC3B,OAAO,EAAE;IACP,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,yBAAyB,CAAC;IACtC,aAAa,EAAE,SAAS,yBAAyB,EAAE,CAAC;IACpD,cAAc,EAAE,OAAO,CAAC;IACxB,eAAe,EAAE,sCAAsC,CAAC;IACxD,0FAA0F;IAC1F,uBAAuB,EAAE,MAAM,CAAC;IAChC,qGAAqG;IACrG,sBAAsB,CAAC,EAAE,+BAA+B,CAAC;IACzD;;;;;OAKG;IACH,WAAW,CAAC,EAAE,4BAA4B,CAAC;CAC5C,GACA,0CAA0C,CAgF5C"}